Malicious Claude Code Extension Reached 5,000 Cursor Users

A tampered build of Anthropic's Claude Code extension sat in Cursor's marketplace for about 11 hours on October 29, reaching as many as 5,000 developers.

The package was Anthropic.claude-code version 2.1.313, and it tried to plant a persistent SSH backdoor on every machine that installed it. Cursor says the malicious versions were not developed by Anthropic, and no compromise of Anthropic's systems has been confirmed.

The exposure window was narrow and exact

Cursor's security notice puts the extension in its VS Code extension marketplace between roughly 2:27 a.m. and 1:35 p.m. Pacific time on October 29, 2026. That window is the whole test: you are at risk only if you installed or updated to 2.1.313 from Cursor's marketplace during it — and automatic updates count. Cursor says at most 5,000 users were affected and that it will contact them directly.

The reach was limited to one channel. Felix Rieseberg, a member of Anthropic's technical staff, posted on X that "a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected and this only impacts Cursor users."

What the payload actually did

The malicious build attempted to add an attacker-controlled SSH key to the developer's authorized_keys file, enable the local SSH service, and open a reverse SSH tunnel. The added key is labeled svc-telemetry — a name that reads like infrastructure plumbing in a file few developers audit.

It then made the tunnel persistent per platform: a LaunchAgent on macOS, a scheduled task or Startup script on Windows. StepSecurity and The Hacker News also report a cron entry on Linux.

The attack mostly failed on the last step, and not by the defender's design. Cursor says enabling SSH requires administrator rights the extension lacks on most macOS and Windows machines, so on those machines the attacker could not log in through the tunnel. Calum Hall, cofounder and CEO of the detection firm Phorion — whose researchers were the first to spot the extension, after detecting it on a customer's Mac — put it bluntly: "Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker."

Luck is not containment. Even on machines where the tunnel never opened, the extension still added the attacker's key, installed persistence, and sent host details back: hostname, username, environment variable names, the configured Git email, and the public IP address. That is a target list for a second attempt.

Uninstalling is not remediation

This is the part teams get wrong. Removing the extension does not undo the payload, because it leaves standalone persistence scripts behind.

If you installed during the window, work through Cursor's published check and remediation steps, and treat the following as the minimum. Search ~/.ssh/authorized_keys for an entry labeled svc-telemetry, and on Windows administrator accounts check C:\ProgramData\ssh\administrators_authorized_keys as well. Remove any key you did not add yourself. Then clear the persistence the payload installs: the LaunchAgent on macOS, the scheduled task or Startup script on Windows, the cron entry on Linux. Turn the SSH server back off if you did not enable it yourself.

Credential rotation is the step that gets deferred and shouldn't be. Any secret the machine could reach — cloud credentials, SSH keys, API tokens, repository tokens, package-registry publish tokens — should be rotated from a different, clean device, and active sessions invalidated. The Hacker News reports that Anthropic has published a clean version, 2.1.314; reinstall at that version or later.

Nobody has explained how it got published

The open question is the uncomfortable one. How the build was published under the extension's name has not been publicly explained, as BleepingComputer notes. Cursor — which is owned by SpaceX — did not return WIRED's request for comment on how the malicious upload happened, or whether it followed a breach at Cursor.

Until that is answered, the control that failed here is unidentified, which means no one outside Cursor can say whether it has been fixed.

The same day, a second trust boundary gave way

October 29 produced an unrelated finding that points at the same surface. Forever Security published its EMBRACE research (researcher Gal Weizman), showing that the preview pane inside Cursor, Copilot, Codex, VS Code and Claude Desktop looks like a browser and was trusted like one — and that the trust was misplaced. Five issues, one boundary. No CVEs were listed for any of them.

The sharpest of the five: a local HTML file could read beyond the project folder. VS Code and Claude Desktop confined the page but not a web worker it starts; Codex had no folder check at all. The researchers demonstrated reads of SSH keys, .env files and npm tokens. A separate finding had GitHub Copilot 1.1.27 letting a page claim github.com/login over a fake form — fixed in 1.1.29 on October 13, independently, before Forever Security filed a report.

Vendor responses diverged. Microsoft and Anthropic declined the reports, citing Workspace Trust; Anthropic had accepted Noma Security's same-class report dated July 24, 2026. OpenAI did not reply to the July 27 report, per the researchers, but told The Register it is aware and working on a fix. As of publication on October 29, Codex and VS Code were unpatched, and Claude Desktop's status was uncertain — Forever Security no longer counts it among open flaws but published no fix version or date. Those statuses are as-of that date and worth re-checking against vendor release notes before you rely on them.

What to watch

Two findings in one day, from unrelated researchers, landed on the same assumption: that the machine a coding agent runs on is a trusted environment. The argument for moving agent execution off the laptop is being made loudly by vendors who sell that isolation — Control Plane CEO Doron Grinstein frames it as "your laptop is your workstation; it should never be your AI agent's execution environment" — and the vendor interest is obvious. The incident behind the pitch is not hypothetical.

Three things worth tracking from here: whether Cursor publishes a root cause for the marketplace publish, whether Codex and VS Code ship fixes for the preview-pane reads, and whether your own CI pins extension or model versions to numbers you have actually verified exist.