The Tampered Claude Code Extension: What Cursor Users Must Check
Key Takeaways
- Claude Code extension backdoor was distributed through Cursor’s extension marketplace on 29 October 2026, in tampered builds of Anthropic’s Claude Code extension, versions 2.1.312 and 2.1.313, for macOS and Windows.
- Cursor says the tampered builds were available from about 2:27am to 1:35pm Pacific time, and that at most 5,000 users received them. Anthropic says its own systems were not compromised and it did not build, publish or host the tampered builds.
- The payload planted a persistent SSH backdoor: it added an attacker key labelled svc-telemetry to the user’s authorised keys, tried to enable the SSH service, and opened a reverse SSH tunnel that retried every 60 seconds.
- Uninstalling the extension does not remove the backdoor, because the persistence survives on its own. Affected users must run Cursor’s remediation scripts and check for the attacker’s key, not just update the extension.
- The clean version is 2.1.314. Other editors are out of scope: the tampered builds were in Cursor’s marketplace only, not in the Visual Studio Marketplace, npm or Open VSX.
Introduction
The most alarming AI security story of the week was not about a model misbehaving. It was about the tool developers use to work with models. On 29 October 2026, a tampered copy of Anthropic’s Claude Code extension sat in Cursor’s extension marketplace for about eleven hours, and up to 5,000 Cursor users received it. The extension looked legitimate, carried the legitimate extension identifier, and behaved like the real thing — except for a small loader hidden in its code that opened a persistent backdoor into the developer’s machine.
The story then got messier, in a way that matters for anyone trying to work out whether they are affected. The first reports blamed the wrong registry. The version numbers changed as the picture clarified. And the most important fact for victims — that deleting the extension does not fix the machine — was easy to miss in the headlines. This article sets out what happened, in the corrected form, who is actually in scope, and the check that matters, without repeating anything that would help an attacker replicate the payload.
What happened, in the corrected timeline
Cursor’s security notice says a maliciously modified version of Anthropic’s Claude Code extension was available in Cursor’s VS Code Extension Marketplace between about 2:27am and 1:35pm Pacific time on 29 October 2026, which is 09:27 to 20:35 UTC. It names versions 2.1.312 and 2.1.313 for macOS and Windows. Cursor says at most 5,000 of its users received the tampered builds in that window.
Security firm StepSecurity published its analysis on 30 October 2026. It found the tampered build identical to the official extension except for a small loader embedded in its extension.js file, about 7 kilobytes larger than the previous release. A clean version, 2.1.314, was published at 01:07 UTC on 30 October — Anthropic skipped the 2.1.313 number on its official channels to avoid confusion, which is why version numbering in early coverage looks inconsistent.
The origin story was corrected in public, and the correction is worth recording because it changes who should worry. Early reports said the tampered build came from Open VSX, the open extension registry. That turned out to be wrong. Cursor told researchers that the compromise was in the Cursor Marketplace, not Open VSX, and StepSecurity corrected its post on 30 October, citing Anthropic: the build was never published to Open VSX, the Microsoft Visual Studio Marketplace or any of Anthropic’s official hosts. Microsoft confirmed the same, saying the packages were never distributed from the Visual Studio Marketplace or npm, and that all evidence points to Cursor’s marketplace alone. One detail remains genuinely confusing, and readers should treat it conservatively: StepSecurity checked the 2.1.312 build on Open VSX and found it clean, while Cursor lists 2.1.312 among the bad versions in its own marketplace. The two 2.1.312 builds are different artefacts from different marketplaces. If you use Cursor and had either version from Cursor’s marketplace in the window, treat yourself as in scope.
Anthropic’s position, stated plainly, is that this was not a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which Anthropic did not build or publish. Its statement, as quoted in coverage, reads: “A malicious actor used access to Cursor’s marketplace to publish a tampered extension targeting Cursor’s users, we were not involved with building, publishing, or hosting this.” The first headlines that said Anthropic had been hacked were wrong, and the distinction matters: the failure was in a marketplace’s publishing controls, not in the model company’s infrastructure, and the fix therefore sits with marketplace verification, not with model safety.
What the payload did
The payload ran as soon as Cursor loaded the extension, without any Claude prompt being needed. According to StepSecurity’s analysis and subsequent advisories, it sent host details to an attacker server — host name, user name, operating system, architecture, home folder, Git email, public IP address and the names of environment variables — over plain HTTP to the address 134.209.82.225. It then added an attacker Ed25519 SSH key, labelled svc-telemetry, to the user’s authorised_keys file, tried to switch on the local SSH service, and opened a reverse SSH tunnel to the attacker’s server, retrying every 60 seconds.
That sequence is what makes this incident severe rather than merely embarrassing. An SSH key in authorised_keys is a standing credential: anyone holding the matching private key can log into the machine, and a reverse tunnel gives them a route in even when the machine sits behind a firewall. The payload also installed persistence mechanisms — on macOS a LaunchAgent, on Windows a scheduled task and a startup file, plus cron entries and small marker files — so that the backdoor survived reboots and survived removal of the extension itself. Cursor warns explicitly that uninstalling the extension may not remove the backdoor, and StepSecurity’s remediation order starts from that fact: keep evidence, then remove the persistence, then the keys, then rotate credentials.
Cursor’s response, as described in its notice, was to remove the malicious builds on detection, take the whole marketplace offline, audit access, find no other tampered extensions, rotate its keys and rebuild the marketplace before bringing it back. The command-and-control address was taken offline with the cooperation of its hosting provider, according to Cursor via StepSecurity. Microsoft published Defender for Endpoint alerts for SSH key additions, SSH tunnelling, plist changes and scheduled tasks, plus Defender Antivirus detection names and advanced hunting queries, while noting that a query match is an investigative lead, not proof of compromise. Having version 2.1.312 or 2.1.313 installed does not, by itself, confirm compromise — but in the window, from Cursor’s marketplace, it puts a machine in scope for checking.
Who is in scope, and who is not
A machine is in scope if all of the following apply: it runs Cursor on macOS or Windows; the Claude Code extension, anthropic.claude-code, was installed or updated to version 2.1.312 or 2.1.313 from the Cursor marketplace; and the install or update happened between about 09:27 and 20:35 UTC on 29 October 2026. If any of those conditions fails, the machine is not in scope for this incident.
Other editors are out of scope. Microsoft’s Visual Studio Code installs from the Visual Studio Marketplace, and Windsurf, VSCodium and other forks install from Open VSX; neither registry carried a tampered build, according to the corrected reporting. Anthropic says its official releases were unaffected. That is genuinely reassuring for the majority of developers — but it is also why the Cursor-only scope must be stated precisely rather than softened into a general warning about extensions. A vague warning helps nobody; a precise scope tells 5,000 people, at most, to act, and tells everyone else they do not need to.
If you are in scope, the check to run is the one Cursor publishes in its notice: look for the svc-telemetry key in your authorised_keys file. Cursor publishes remediation scripts, remediate-macos.sh and remediate-windows.ps1, that remove the persistence and exit non-zero if anything remains. The order of operations matters, and it is worth stating because it runs against instinct. Do not start by uninstalling the extension and assuming the job is done — that leaves the backdoor running. Preserve evidence first if you can, run the remediation, verify the key is gone, update to 2.1.314 or later, and then rotate exposed credentials and sessions from a trusted machine: source-control and CI tokens, cloud credentials, SSH keys and package registry tokens accessible from the affected host. A developer machine is a bundle of credentials, and a backdoor that lived on it for hours must be treated as a credential incident, not just a malware cleanup.
The lesson is about marketplaces, not models
The wider lesson of this incident is not that AI coding tools are unsafe in some general sense. It is that the extension marketplace is now a critical software supply chain, and it was attacked as one. Developers install extensions with the same trust they once reserved for packages from their operating system vendor, and an extension runs with the user’s privileges on their machine, with access to their files, their SSH keys and their cloud credentials. A marketplace that allows a tampered build to be published under a legitimate publisher’s identifier, even for eleven hours, has suffered a failure of its core function — and the fact that Cursor caught it, took the marketplace down, audited it and rebuilt it is the response that matters, not the reassurance that only 5,000 users were affected. Five thousand developer machines is a large incident by any measure.
For teams, the practical controls follow from that framing. Pin extension versions where your tooling allows it, and treat unexpected extension updates on a single day as an event worth noticing. Separate development machines from machines holding production credentials where possible. Monitor authorised_keys files and SSH service state as a matter of routine, not only after an incident. And when a vendor publishes a remediation script with a non-zero exit code for leftover persistence, run it and check the exit code, rather than trusting a green update badge.
The incident also shows why corrections in security reporting deserve as much attention as the initial disclosure. The first version of this story pointed at the wrong registry, and a developer who checked Open VSX and found it clean might have concluded they were safe while running a tampered build from Cursor. Security advice ages badly when the facts change, and the corrected record — Cursor marketplace only, both 2.1.312 and 2.1.313, macOS and Windows, persistence surviving uninstall — is the version that should be acted on.
For the wider security context, see our coverage of UK AI security funding and the plan to defend against AI threats, and for how AI agents work in the tools developers use every day, our explainer on AI agents and how they operate.
