Cursor: Malicious Claude Code extension affected up to 5,000 users
Cursor confirmed on October 29, 2026, that a malicious modified version of Anthropic.claude-code 2.1.313 had appeared in its VS Code extension marketplace. This version was not developed by Anthropic. Up to 5,000 users were affected, and the company will contact them directly.
The malicious version was available for download for roughly 2:27 to 13:35 Pacific Time that day. After the extension was loaded, it attempted to install a persistent SSH backdoor: collecting host and user information (hostname, username, operating system, architecture, home directory path, environment variable names, working directory, configured Git email, and public IP), adding an attacker-controlled SSH key to authorized_keys (commented as svc-telemetry), attempting to enable the local SSH service and establish a reverse tunnel to 134.209.82.225, persisting via a macOS LaunchAgent or a Windows scheduled task, retrying about every 60 seconds, and sending status to /beacon on port 8099.
Cursor immediately removed the version, closed the marketplace for an audit, rotated keys and rebuilt the marketplace before restoring it online, and worked with the hosting provider to take the attacker’s server offline. The company confirmed that no other extensions were affected and advised users to update to 2.1.314. There is no evidence that the official distribution channels or other versions of the extension were affected.
Original sources:
Title: Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace Publisher: Cursor Publication date: 2026-10-29 URL: https://cursor.com/blog/claude-code-extension-security-notice Source type: official company security notice Verification status: the full text was actually read for this report, verification date 2026-10-30 Supporting details: the malicious version time window, upper bound on affected users, backdoor behavior details, response measures, and statement that it was not developed by Anthropic
Title: Cursor official X statement Publisher: Cursor (@cursor_ai) Publication date: 2026-10-30 URL: https://x.com/cursor_ai/status/2116074289053175808 Source type: official company statement Verification status: the post text was actually read for this report, verification date 2026-10-30 Supporting details: confirmation that up to 5,000 users were affected, that it was not developed by Anthropic, that the marketplace has been restored, and that users should update to 2.1.314
ABAB AI Insight
Cursor is an AI code editor based on VS Code and runs its own extension marketplace to distribute plugins. In this incident, the attacker embedded malicious code in the front end of extension.js for Anthropic.claude-code 2.1.313, creating a supply-chain attack. This version existed in the Cursor marketplace only briefly, for about 11 hours, and the company limited the affected scope to up to 5,000 users. Cursor also emphasized that the version was not developed by Anthropic, and that other extensions and official channels were not affected.
The backdoor design included information collection, SSH key insertion, reverse tunneling, and persistence mechanisms. Cursor pointed out that enabling the local SSH service would fail on most macOS and Windows hosts because of the lack of administrator privileges, so attackers could not log in through the tunnel, but key insertion, persistence, and information exfiltration would still occur. The attacker’s server has been taken offline, and the reverse connection is no longer effective.
This incident changes the trust model for developer tool extension marketplaces: even an extension labeled as coming from a well-known vendor (Anthropic) may be tampered with in a third-party market. For developers using Cursor, supply-chain risk extends from official channels to marketplace distribution. Key metrics to watch are the proportion of affected users who actually executed the backdoor, whether credential abuse appears later, and whether signature and integrity verification mechanisms in extension marketplaces for AI coding tools are strengthened.
ABAB News · Cognition Law
An extension package labeled as a vendor’s official package in a third-party marketplace can still be tampered with and distributed, with the scope of impact controlled by the distribution platform rather than the original vendor.
A persistent backdoor can still achieve partial control through key insertion and information exfiltration even if the remote login step fails because of permissions.
Distribution of a malicious package over a short time window (about 11 hours) can keep the number of affected users within the platform’s self-reported range of up to 5,000 people.