Tampered Claude Code Extension in Cursor's Marketplace Tried to Plant an SSH Backdoor
Malicious versions 2.1.312 and 2.1.313 were live for about 11 hours on October 29. Cursor and Microsoft say the attacker's server is offline, but files left on affected machines must be removed by hand.
Published
Last updated / Fact-checked on
A maliciously modified Claude Code extension was available in Cursor's VS Code Extension Marketplace for about 11 hours on October 29, Cursor said. Versions 2.1.312 and 2.1.313 for Windows and macOS tried to plant an attacker's SSH key and open a reverse SSH tunnel. Anthropic did not build them. If you installed either version in that window, check for a key labeled svc-telemetry.
Photo: Markus Spiske / Pixabay
What happened
The tampered versions were live from about 2:27 a.m. to 1:35 p.m. PT, according to Cursor. Cursor initially said at most 5,000 users may have installed it, The Verge and other outlets reported on October 30. A revised notice later that day clarified the affected versions and no longer gives a number.
Microsoft said the packages were never published on the Microsoft Visual Studio Marketplace or the official npm package. Anthropic told Microsoft its systems were not compromised. "All evidence suggests that the incident is limited to Cursor marketplace," Microsoft wrote.
| Item | Detail |
|---|---|
| Affected | Anthropic.claude-code 2.1.312 and 2.1.313, Windows and macOS, from Cursor's marketplace |
| Window | Oct 29, about 2:27 a.m. to 1:35 p.m. PT |
| Possible installs | Up to about 5,000, per Cursor's first notice |
| Marker | SSH key with the comment svc-telemetry |
| Attacker server | Offline |
What the extension did
Microsoft found injected JavaScript that runs when the extension loads, before its normal code. According to Cursor and Microsoft, it:
- collected the hostname, username, operating system, architecture, home directory, working directories, Git email and public IP, plus the names, but not values, of environment variables with terms like KEY or TOKEN
- added an attacker-controlled SSH key, labeled
svc-telemetry, to the user'sauthorized_keysfile - tried to enable the local SSH service and open a reverse SSH tunnel
- set up persistence with a LaunchAgent named
com.apple.sysmondon macOS, or a scheduled task namedSysMonon Windows with a Startup-folder fallback - retried the tunnel about every 60 seconds and reported host details to the attacker
It hid errors and kept the extension working normally so users would not notice, Microsoft said.
Turning on SSH needs administrator rights, which the extension lacks on most macOS and Windows machines. On those hosts, Cursor said, the attacker could not have logged in through the tunnel. But the extension still added the key, installed persistence and sent host details.
Cursor's response
Cursor said it pulled the malicious versions immediately, blocked further distribution and shut down the whole marketplace as a precaution. It audited access and found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back online. It also worked with the hosting provider to take the attacker's server offline.
What to do
Uninstalling the extension is not enough, both companies say, because the payload writes files outside the extension folder.
If you installed 2.1.312 or 2.1.313 from Cursor's marketplace in the window:
- Run Cursor's check for the
svc-telemetrykey. On Windows, also checkC:\ProgramData\ssh\administrators_authorized_keys. - Before cleaning up, preserve evidence such as the extension package, changed SSH files and startup entries, as Microsoft advises.
- Isolate any affected machine.
- Remove the key, persistence files and tunnel processes, or run Cursor's remediation scripts. Microsoft says to inspect each startup item before deleting it, because the names mimic real system tools.
- Consider rebuilding the machine.
- From a clean device, rotate credentials and sessions that the machine could reach.
For organizations, Microsoft points to Cursor's security-hardening guidance: restrict extensions to approved publishers and set an installation cooldown for newly published versions.
Why it matters
This was a supply-chain attack through a trusted name in an editor's own marketplace. Users did not need to click anything suspicious; installing or updating the extension was enough. The attacker's server is down, but anything it planted stays until removed.
More coverage is on our Artificial Intelligence hub.
How we reported this
We read Cursor's security notice, including its October 30 update, and Microsoft's analysis in full. The install figure comes from Cursor's first notice as reported by The Verge; Cursor's current notice gives no number. We did not analyze the extension ourselves. The table summarizes both companies' findings.
Published and fact-checked October 31, 2026.
Sources
- Cursor, "Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace," Oct. 29, 2026, updated Oct. 30: https://cursor.com/blog/claude-code-extension-security-notice
- Microsoft Security Blog, "Inside a malicious Claude Code-branded extension and its persistent SSH backdoor," Oct. 30, 2026: https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/
- The Verge, "Cursor says around 5,000 people may have installed a malicious Claude Code extension," Emma Roth, Oct. 30, 2026: https://www.theverge.com/ai-artificial-intelligence/1023096/cursor-says-around-5000-people-may-have-installed-a-malicious-claude-code-extension
DailyMech used AI tools to help research and draft this article; it was fact-checked by our editors.