On 29 October 2026, between about 2:27 am and 1:35 pm Pacific time, the Cursor VS Code Extension Marketplace distributed a maliciously modified build of the extension Anthropic.claude-code, published under the real extension ID. Cursor says the build "was not developed by Anthropic"; Anthropic says a malicious actor used access to Cursor's marketplace to publish it and that it was not involved in building, publishing or hosting it. How the attacker got that access has not been disclosed, and nobody has been named as responsible.
Which versions and how many users: early reports and Help Net Security name version 2.1.313; Cursor's notice, updated on 30 October, lists 2.1.312 and 2.1.313 for Windows and macOS. Cursor has said at most 5,000 users were affected and that it will contact them. Version 2.1.314 replaced the bad build. Some early reports said the package was also on Open VSX; others, including Manifold Security's Ax Sharma, dispute this and say Cursor's marketplace was the source.
What the payload does: a loader added to extension.js runs as soon as the editor loads the extension, with no user action. It sends host details (hostname, user name, OS, directories, Git email, public IP and the names of up to 40 key-like environment variables) to the attacker, adds an SSH key labelled svc-telemetry to authorized_keys, installs persistence (a LaunchAgent on macOS, a scheduled task named SysMon on Windows, a reboot cron entry on Linux) and tries to open a reverse SSH tunnel, retrying about every 60 seconds.
Cursor says enabling the SSH service needs admin rights and bugs in the code make that step fail in most cases, and the attacker's server has been taken offline. Researchers warn this is no real protection: the key and persistence remain, and the backdoor works if SSH is already on or is turned on later. Cursor temporarily took its whole marketplace offline, rotated keys, rebuilt it and says no other extensions were tampered with.
