Malicious Claude Code Extension Exposed Developers Through Cursor Marketplace

Cursor has disclosed a software-supply-chain incident involving malicious versions of the Anthropic.claude-code extension distributed through its VS Code Extension Marketplace. Versions 2.1.312 and 2.1.313 for Windows and macOS were available on October 29, 2026, before Cursor removed them and rebuilt the marketplace.

What the extension attempted

According to Cursor’s security notice, the modified package collected host and user details including the hostname, username, operating system, architecture, home-directory path, environment-variable names, working directories, configured Git email and public IP address. It also attempted to add an attacker-controlled SSH key, enable the local SSH service and create a reverse SSH tunnel.

The package included persistence mechanisms intended to retry the tunnel roughly every 60 seconds. On macOS, the code used a LaunchAgent; on Windows, it attempted a scheduled task running as SYSTEM, with a startup-script fallback. Cursor said the attacker’s server was taken offline, but warned that removing the extension alone may not remove files or persistence mechanisms already written to a machine.

Microsoft confirms the marketplace boundary

Microsoft Threat Intelligence independently analyzed the injected JavaScript and described the same chain: reconnaissance, SSH authorization, reverse forwarding, persistence and reporting to attacker infrastructure. Microsoft said the incident was limited to Cursor’s marketplace, not Microsoft’s Visual Studio Marketplace or npm. Successful remote access depended on host privileges, SSH configuration and attacker-server conditions, but the loader could still write keys and persistence artifacts even when the tunnel failed.

Microsoft recommends identifying systems that installed or automatically updated to the affected version from Cursor, preserving evidence, reviewing endpoint and network telemetry, and removing confirmed malicious artifacts. Organizations should inspect the relevant authorized_keys files and verify the exact unauthorized key before removal. Credential rotation or session revocation should follow an investigation indicating exposure.

Recommended response for affected users

Cursor advises users who installed or updated to either affected version during the exposure window to run its platform-specific validation and remediation steps. Checks include searching for the key label svc-telemetry, isolating systems showing payload execution or backdoor installation, removing unauthorized SSH and persistence artifacts, and assessing whether rebuilding the host is appropriate. Users should also rotate credentials and sessions accessible from a potentially affected machine, using a trusted system.

The incident is a reminder that official distribution channels do not eliminate supply-chain risk. Extension versions, publisher identity, automatic updates and host-side artifacts all require verification when a marketplace package is found to be tampered with.

Sources

https://cursor.com/blog/claude-code-extension-security-notice

https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/

https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/