On October 29, 2026, a tampered version of the Claude Code extension was distributed through the Cursor Marketplace as an ordinary update. According to The Hacker News, researchers at OpenSourceMalware disclosed that version 2.1.313, published under Anthropic's legitimate extension ID (anthropic.claude-code), carried a loader that added an attacker-controlled SSH key to affected machines. Cursor said at most 5,000 users were affected. Cursor said the malicious version was not developed by Anthropic.
What happened
Anatomy of the 12-hour window
What happened, in order, as reported by Cursor, Anthropic and security researchers.
- Oct 29, ~2:27 a.m. PTVersion 2.1.313 appears under anthropic.claude-code in Cursor's marketplace
- On webview openA 66-line loader runs ahead of the real code and adds an SSH key labeled "svc-telemetry"
- ThenPersistence (scheduled task, crontab, LaunchAgent) and a reverse tunnel; host details beaconed over HTTP
- Oct 29, ~1:35 p.m. PTLast install in Cursor's estimated window (up to 5,000 users)
- Oct 30Malicious version removed; clean 2.1.314 is the latest release
Cursor said affected users installed the malicious version between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29. That is roughly 11 hours, consistent with Anthropic's description of about 12 hours. Users with auto-update enabled could have received it without any action. Cursor temporarily shut down its marketplace to remove the package, rotated keys, rebuilt the marketplace, and worked with its cloud provider to take the attacker's server offline, which disabled the reverse shell, per The Hacker News.
An earlier version of the story reported that the Open VSX registry had been compromised. The publication later corrected this: only the Cursor Marketplace was affected. Socket found no evidence of Open VSX distribution, and Microsoft confirmed the extension was not on the Visual Studio Marketplace or npm. The latest Anthropic release on Open VSX and the VS Code Marketplace is 2.1.314.
How the loader worked
According to the reporting, a 66-line loader was inserted into the extension's main JavaScript bundle, ahead of the legitimate code. It activates after VS Code starts and a webview opens, and then:
- Adds an attacker-controlled SSH key, labeled "svc-telemetry", to the user's authorized_keys file.
- Attempts to enable SSH on Windows, Linux and macOS, and opens a reverse tunnel to a hard-coded IP address.
- Sets up persistence through a scheduled task, crontab and LaunchAgent.
- Sends host reconnaissance over unencrypted HTTP: public IP, hostname, username, OS and CPU architecture, directories, the global Git email, and the names (not the values) of up to 40 environment variables whose names contain terms such as KEY, TOKEN, SECRET, PASS, AWS or GCP.
No follow-on payloads have been observed. The names-only collection is notable: it tells an attacker which credentials exist on a machine without exfiltrating them, which suits a staged operation. That is an inference from the design, not a reported intention.
Where responsibility sits
A malicious actor used access to Cursor's marketplace, and the tampered version stayed live for about 12 hours.
Anthropic's account, as reported by The Hacker News
Anthropic said its systems and employee laptops were not compromised, and that official channels including VS Code and Open VSX are not affected. Cursor said no other extensions were modified. The reporting leaves two questions open: how the attacker managed to publish under Anthropic's name on Cursor's marketplace, and what level of access they obtained. Until those are answered, it is not possible to say whether the weakness was in publisher verification, credentials, or the marketplace's publishing pipeline.
A limit on the attack, and a caveat
Enabling SSH generally requires administrator rights, which an editor extension usually lacks on macOS and Windows. Cursor said that even so, the key and persistence artifacts are still written. Microsoft made the same point: the loader may leave keys and startup entries even if the tunnel fails. So "the tunnel did not connect" is not evidence that a machine is clean.
AnthropicRemediation steps reported
Microsoft and others recommend the following for anyone who installed or auto-updated to 2.1.312 or 2.1.313 from Cursor's marketplace:
- Identify affected systems and preserve evidence.
- Isolate affected hosts.
- Remove confirmed malicious artifacts and review endpoint telemetry.
- Rotate credentials and revoke sessions.
- Remove the unauthorized SSH keys, tunnel identities, scripts and startup entries separately, because uninstalling the extension does not remove them.
Cursor said it will contact affected users directly.
Why this matters beyond one extension
AI coding assistants run with the developer's own privileges, in the environment where SSH keys, cloud tokens and source code live. A malicious update to one is therefore a high-value target. Three structural points stand out:
- Trust is attached to an ID. Marketplaces typically treat a matching extension ID as the publisher's identity. When the marketplace itself is the weak point, that signal fails.
- Auto-update is both a fix and an exposure. It delivers patches quickly and delivers a tampered build just as quickly. Teams often weigh this with update rings or pinned versions.
- Fork ecosystems multiply surfaces. The same extension can be distributed through several registries with different controls, as this incident shows.
Teams using a model-agnostic workspace such as Metir can reduce dependence on any one editor's extension channel, but the general mitigations remain standard: least-privilege credentials, short-lived tokens, and monitoring of authorized_keys changes.
Sources:
Image credits
- Lobby of Anthropic's San Francisco office during the October 2024 visit of UK Secretary of State Peter Kyle, by Alecsandra Dragoi / DSIT, via Wikimedia Commons, licensed CC BY 2.0. Illustrative only; reviewed visually.