Backdoored Claude Code Extension Hit Cursor’s Marketplace: Are You Affected?

For roughly 11 hours on Thursday, 29 October 2026, a compromised version of the Claude Code extension was distributed through the extension marketplace of AI code editor Cursor. Releases 2.1.312 and 2.1.313 of the Anthropic.claude-code package contained unauthorized modifications designed to extract host details and establish remote access. Cursor confirmed that the tainted builds “were not developed by Anthropic” and said in a post on X that at most 5,000 users were affected. It pulled the builds, took the whole marketplace offline, rebuilt it and brought it back.

Verifying Whether You Are Affected

The malicious builds were active between 09:27 and 20:35 UTC on 29 October 2026, corresponding to 12:27 to 23:35 Riyadh time. Because Cursor updates extensions automatically by default, developers running the editor during that window received the package silently. The payload runs immediately upon file loading without requiring the user to open the extension.

With official notices published solely in English and no Arabic guidance provided, regional developers must verify their machines directly. Many engineers use Cursor and Claude Code with paid API keys. If you updated the extension on macOS or Windows during the incident window, check your SSH authorized_keys file for the label svc-telemetry. Cursor provided one-line commands in its security notice. Finding that label confirms your device ran the backdoor.

Malware Behavior and Execution Flaws

Technical analysis by security firm Phorion revealed that the implant gathered host details: operating system, architecture, username, hostname, home directory, working paths, Git email, public IP, and the names of all environment variables. While actual values were not read, Phorion noted that variable names let attackers catalog cloud accounts and API tokens to pick targets for follow-up intrusions.

The implant attempted persistence via a LaunchAgent on macOS or a scheduled task named SysMon on Windows, while retrying a reverse SSH tunnel every 60 seconds. It also contained setup logic for Linux. However, enabling local SSH requires administrative privileges that the extension lacked on typical setups, so on most Macs and Windows PCs the attacker could not actually log in through the tunnel. The key, the persistence and the host report still landed, though. Code bugs also broke parts on Windows and macOS, and Cursor worked with the host provider to take the attacker server offline.

Immediate Remediation Steps

Uninstalling the extension from the editor is insufficient because the backdoor drops standalone background scripts. Affected users should follow these steps:

• Run cleanup scripts: Execute Cursor’s remediation scripts to terminate rogue processes and delete persistence entries. Run remediate-macos.sh under your standard user account, or execute remediate-windows.ps1 in an administrative PowerShell terminal.
• Rotate credentials: From a separate, trusted device, immediately reset all API keys, tokens, and cloud secrets reachable from the compromised machine.
• Isolate and investigate: Organizations should isolate affected hosts and review telemetry indicators provided by Cursor, while individuals should consider rebuilding their machines.

Unresolved Questions and Future Safeguards

Several key facts remain unexplained. Reporting by Ars Technica noted that the malicious package was published through Anthropic’s official marketplace account, but neither company has explained how the account was breached. We found no public statement from Anthropic as of Saturday morning. The attacker’s identity and whether data beyond host details was stolen also remain unknown. Cursor says it has no evidence that other versions of the extension, or Anthropic’s official distribution, are affected.

Our view: automatic extension updates in coding editors introduce a genuine supply-chain risk. Developers should consider disabling automatic extension updates in Cursor’s settings, updating manually after waiting a few days for community vetting, and regularly removing unused extensions.