Developers who use the AI coding editor Cursor are being urged to check their machines after tampered copies of Anthropic’s Claude Code extension sat in Cursor’s extension marketplace for about 11 hours on October 29, 2026. Cursor says at most 5,000 of its users received the tampered builds, which were not developed by Anthropic and tried to plant a persistent backdoor on affected computers.
The incident is a reminder of how much trust developers place in the tools that run inside their editors. An extension does not only help write code. Once installed, it can run code on the machine, and a tampered version can use that access in ways the user never sees. In this case, researchers say the malicious code ran as soon as the extension loaded, whether or not the user started a Claude conversation.
Key Takeaways
- Cursor says tampered Claude Code extension versions 2.1.312 and 2.1.313 were available in its marketplace for about 11 hours on October 29, 2026, reaching at most 5,000 users.
- Anthropic says its own systems were not compromised, and the tampered builds were never published through its official channels.
- Uninstalling the extension alone does not remove the backdoor, because the loader installed persistence that keeps running after the extension is gone.
What Happened in the 11-Hour Window
According to Cursor’s security notice, as reported by security researchers, the tampered builds were available in the Cursor VS Code Extension Marketplace from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29, which is 09:27 to 20:35 UTC. The builds carried the legitimate extension identifier, Anthropic.claude-code, rather than a lookalike name, which made them harder for users to spot. Cursor names versions 2.1.312 and 2.1.313 for macOS and Windows.
StepSecurity’s analysis describes a small loader placed ahead of the normal extension code in the extension’s main file. Researchers found the tampered build was otherwise identical to the official extension, apart from that loader, which was about 7 KB larger than the previous release in the version they examined. The loader ran when the extension module loaded, so the malicious behaviour did not depend on a user starting a coding session.
Cursor says it removed the affected versions on detection, then took the whole marketplace offline, audited other extensions, found no other tampered extensions, rotated its keys and rebuilt the marketplace before bringing it back. A clean version, 2.1.314, was published on October 30. Microsoft Threat Intelligence published its own analysis of the loader on October 30, and Microsoft listed Defender detections for the activity.
What the Tampered Builds Tried to Do
Researchers say the loader collected host and user details, including hostnames, usernames, operating systems, architecture details, home-directory paths, environment-variable names, working directories, configured Git email addresses and public IP addresses, and sent that reconnaissance to an attacker server over plain HTTP. Cursor has said that server has since been taken offline with the cooperation of its hosting provider.
The builds also tried to add an attacker-controlled SSH key labelled svc-telemetry to the user’s authorized keys, enable the local SSH service and open a reverse SSH tunnel back to attacker infrastructure. They installed persistence mechanisms so the access would survive a restart: a LaunchAgent on macOS and a scheduled task with a startup-script fallback on Windows. Cursor said enabling the local SSH service required administrator privileges and that errors in the malicious code meant this step would fail on most affected computers unless the editor was running with elevated permissions.
Uninstalling the extension alone does not remove the backdoor, because the loader installed persistence that keeps running after the extension is gone.
That last point is the most important one for anyone who installed or updated the extension in the window. Cursor has published remediation scripts for macOS and Windows that remove the persistence and exit with an error if anything remains. Affected users are advised to follow Cursor’s cleanup instructions, check for the svc-telemetry SSH key, remove persistence mechanisms and any running tunnel processes, and rotate credentials that were accessible from the affected machine, using a trusted device to do so. A machine is in scope only if it runs Cursor on macOS or Windows and installed or updated to version 2.1.312 or 2.1.313 from Cursor’s marketplace in that window, so a version installed before October 29 is not automatically suspect.
A Correction That Matters: It Was Not Anthropic’s Systems
The first headlines left many readers with the impression that Anthropic itself had been hacked. Anthropic has disputed that account. Felix Rieseberg of Anthropic said this was not a compromise of Anthropic’s systems or employee laptops, and Anthropic said a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the extension, which Anthropic did not build, publish or host.
Early reports also said the build came from Open VSX, an open extension registry. That account was corrected on October 30: Anthropic confirmed the tampered build was never published to Open VSX, the Microsoft Visual Studio Marketplace or any of its official hosts, and Cursor confirmed the compromise was in its own marketplace. The distinction matters, because it decides where users should look for the bad version and which distribution channels can be trusted. The incident is a supply-chain story about a marketplace copy, not about Anthropic’s own code, and that is why the same extension from official channels is not affected.
The wider context is a week in which trust in AI tools has been under scrutiny from several directions. The same AI companies have been facing pressure over how their systems are trained and deployed, as covered in our report on the pledge by OpenAI, Google, Microsoft and Anthropic to give publishers one switch to block AI training scraping. Security incidents in adjacent markets have also made headlines, including the Binance hack losses covered after withdrawals were paused. And researchers continue to test AI systems against hostile uses, as in controlled tests of a Chinese AI model against cyberattacks.
- Tampered versions: Claude Code extension 2.1.312 and 2.1.313 in Cursor’s marketplace only.
- Exposure window: about 11 hours on October 29, 2026, from 09:27 to 20:35 UTC.
- Cursor’s figure: at most 5,000 users received a tampered build.
- Payload: host reconnaissance, an attacker SSH key labelled svc-telemetry, per-OS persistence and a reverse SSH tunnel.
- Fix: tampered versions removed, marketplace rebuilt, clean version 2.1.314 published on October 30.
- Key warning: uninstalling the extension does not remove the persistence; run Cursor’s remediation scripts.
What to Watch Next
What to watch next is whether Cursor publishes further detail on how the marketplace access was obtained, whether any affected users report confirmed misuse of credentials or machines, and whether other extension marketplaces tighten their checks on published builds after this incident. Readers should also watch for Cursor’s remediation guidance to be updated, for the clean 2.1.314 version to be confirmed on their machines, and for any further clarification of which machines fall inside the October 29 window. Until then, the verified picture remains the one set out above: a tampered marketplace copy, a limited exposure window, a persistent backdoor that outlives uninstallation, and a cleanup step that affected users should not skip.