Ing. Calogero Bono
On October 29, 2026, a tampered version of the Claude Code extension from Anthropic was available for about 11 hours on the marketplace of Cursor, the AI-powered code editor. It carried version number 2.1.313 and tried to install a persistent SSH backdoor. Cursor says at most 5,000 users were affected. The story matters because the package appeared under the identity of the legitimate publisher, and anyone with automatic updates enabled may have received it without doing anything.
A few terms before we get into the facts. A backdoor is a hidden way into a computer, left open for whoever planted it. SSH is the protocol used to connect remotely to a machine through the command line. A reverse tunnel is a connection that starts from the victim's computer and reaches out to the attacker, so it can get past firewalls and routers. An extension marketplace is the store from which the editor downloads add-ons. A supply chain attack targets a supplier or a distribution channel instead of the final target.
What happened on Cursor?
According to BleepingComputer, version 2.1.313 was distributed between 2:27 and 13:35 Pacific time on October 29. Cursor is built on Visual Studio Code, Microsoft's open source editor, and supports its extensions. The Claude Code extension brings Anthropic's programming assistant inside the editor.
Cursor said the malicious version was not developed by Anthropic. The Hacker News notes, however, that this clarification does not settle the problem. The attackers distributed it under the official extension identifier, anthropic.claude-code, not as a copy with a different name. To anyone looking at the editor, it looked like a normal update.
Jenn Gile, co-founder of OpenSourceMalware, explained that the package contains a 66-line malicious loader inserted ahead of the legitimate code. The rest of the extension, according to researchers at Phorion and OpenSourceMalware cited by BleepingComputer, was left unchanged. That is why the package kept working as expected.
Cursor removed the extension and temporarily shut down the entire marketplace to check the other extensions and rotate all access keys. Working with its hosting provider, it also had the attacker's server taken offline. After an internal investigation, the company says it found no evidence of other compromised versions or of the official distribution being compromised.
How did the malicious code work?
The code runs when the extension loads, without the user touching Claude Code. According to The Hacker News, it activates after VS Code starts and when the webview opens. Then it carries out a precise sequence.
- It adds an attacker's key to the
~/.ssh/authorized_keysfile, labeled «svc-telemetry» so it looks harmless. - It tries to make the machine reachable via SSH on Windows, Linux and macOS and opens a reverse tunnel to an IP address controlled by the attacker.
- It installs persistence, meaning a scheduled task, a crontab entry or a LaunchAgent, with reconnection attempts roughly every minute on macOS and Windows.
- It sends machine data to an attacker's server through an unencrypted HTTP request on port 8099.
The data collected includes public IP, host name and local user, operating system and CPU architecture, home and working directories, the global Git email, and the names of up to 40 environment variables containing words like KEY, TOKEN, SECRET, PASS, AWS or GCP. The values of the variables are not included in the first message. As researcher Paul McCarty points out, however, the names alone are enough to reveal which cloud services and which credentials are configured.
The attackers' mistakes
According to Phorion, bugs in the SSH configuration routines would have prevented remote access on many Windows and macOS systems. On macOS, the malware checks whether remote access is enabled using a command run without privileges, and gets an error instead of the status. It enables SSH only if it sees the word «Off», so it skips that step. On Windows it tries to install the OpenSSH server through /bin/sh, a Unix shell that is normally not present.
Cursor's analysis also explains that enabling the SSH service requires administrator rights, which the extension usually does not have. The tunnel therefore gives no access if the SSH server was not already running. The key, persistence and data sending, however, remain active.
How do you know if you were hit?
Cursor estimates at most 5,000 users, among those who installed the version during the roughly 11-hour window. It also said it will contact affected users directly. Gile warns that anyone with Claude Code set to update automatically may have received the malware. The exposure window was short, but for an automatic update it was enough.
The first check recommended by BleepingComputer is to search your computer for an SSH key named «svc-telemetry». If impact is confirmed, follow Cursor's instructions. For affected machines, the advice is to isolate them, rotate any reachable secrets, invalidate sessions and rebuild the environment from secure backups. The Hacker News adds removing the unauthorized key and the persistence mechanisms. Cursor insists on following these steps even when SSH access failed.
Anyone who installed Claude Code from Open VSX or from Microsoft's official marketplace is not reported as affected. Early reports also mentioned those channels, but they were corrected, and Cursor is the only confirmed source of the malicious version.
What does version 2.1.314 change?
The Hacker News reports that as of October 30, 2026, the malicious version had been removed and Anthropic had published 2.1.314 on Open VSX and on Microsoft's marketplace. The official release notes on GitHub, in the part we could read, do not mention the incident. Instead they list dozens of fixes and some new features for enterprise environments.
Among them is the permissions.blockWritesOutsideWorkingDirectories setting, which makes Write, Edit and NotebookEdit refuse paths outside working directories in every permission mode. These changes are not linked to the attack, and that conclusion is ours, not something we present as a response. They do show what the issue is about, namely the limits to place on an assistant that writes to disk.
Limits to know
- It is not clear how the attackers managed to publish the package under Anthropic's name on Cursor's marketplace.
- It is not known whether Cursor's or Anthropic's systems were compromised. BleepingComputer contacted both companies and reports no replies.
- The figure of 5,000 is a maximum stated by Cursor, not a count verified by third parties.
- No later payloads have been observed, but the tunnel would have allowed running commands or transferring files if SSH was active.
- That access failed on many systems is an assessment by Phorion and Cursor, not a guarantee for every machine.
What it means for anyone working with digital tools
For developers, the risk does not lie only in the libraries you import. It also lies in the tools you use to write code. An extension has access to files, environment variables and SSH keys on your machine, and often to those on client servers.
For an agency or company with developers, the practical question is who can install what. If a work laptop holds production keys, a compromised extension becomes a problem for every connected system. The issue falls under supplier management, as we explain in our guide to the NIS2 supplier register and supply chain security for SMEs.
This also applies to servers. If you manage machines with managed hosting and servers, periodically checking authorized_keys is a simple habit that would have surfaced the anomalous key here. On the AI assistant front, security differences between providers should be weighed carefully, as in our comparison of Claude and OpenAI.
Our take
The statement that it was not developed by Anthropic is technically true and practically not very useful. For the user, the package was Claude Code, with the right name and a version number that followed the real series. When a marketplace allows this, trust in the publisher's name no longer protects you, and the burden falls on whoever installs.
The case also shows a limit of automatic updates. They are useful for security patches, but in this episode they were the delivery channel. We are not saying to turn them off everywhere. We are saying that on machines with sensitive access, a delay of a few hours or a check on extensions has a low cost.
We found Cursor's speed in shutting down the marketplace and stopping the attacker's server commendable. The central question remains open, though, namely how the version was published. Until there is an explanation, any assessment of future risk is provisional. The attackers' mistake limited the damage, and it would be unwise to count on that next time. Anyone using AI assistants in their code should pair them with serious review, as we note in our guide to AI-assisted code review.
Frequently asked questions
Am I at risk if I use Claude Code on VS Code?
Generally no. The sources report no malicious versions on Open VSX or on Microsoft's official marketplace. The problem concerns anyone who installed or updated the extension from Cursor's marketplace between 2:27 and 13:35 Pacific time on October 29.
How do I check whether I have the malicious key?
Open the ~/.ssh/authorized_keys file and look for a key labeled svc-telemetry. If you find it, follow Cursor's instructions, isolate the machine and rotate any reachable credentials.
Could the attacker have gotten into my computer?
It depends. According to Cursor and Phorion, on many Windows and macOS systems enabling SSH failed due to lack of rights or errors in the code, so the tunnel gave no access. If SSH was already active, the risk remains, so it is worth checking.
Were my passwords stolen?
According to BleepingComputer, the malware does not directly steal credentials. It does send data such as IP, username, Git email and names of sensitive environment variables. With SSH access, the attacker could have looked for more by hand.
Should I turn off automatic updates?
This is not a recommendation from the sources. Gile notes that anyone who had them enabled may have received the malware. Decide for yourself, based on the secrets stored on the machine and how much you trust the marketplace you download from.
What to watch in the coming months
We expect explanations from Cursor and Anthropic on how the version was published. Also watch whether similar cases appear on extension marketplaces. In the meantime, there are three practical steps.
- Check
authorized_keyson laptops and servers, and remove keys you do not recognize. - Keep production secrets off development machines and use short-lived credentials.
- List the extensions installed in your editors and remove those you do not use.
