A malicious Claude Code extension sat in Cursor's marketplace for about 11 hours on October 29, 2026, and tried to install a persistent SSH backdoor on the machines that ran it. Cursor disclosed the incident the same day and says at most 5,000 users were exposed. If you installed or updated the extension that day, removing it is only the first step.
The tampered package used the identifier Anthropic.claude-code and version 2.1.313. Cursor's security notice is direct about where it came from: "This malicious version of the extension was not developed by Anthropic." The company has not explained how attackers got a build published under Anthropic's name, and that is the first question developers should ask about this incident.
What the malicious Claude Code extension tried to do
Cursor says the bad build was live from about 2:27 a.m. to 1:35 p.m. PT, a window of roughly 11 hours. According to the notice, the code was designed to add an attacker-controlled SSH key to the authorized_keys file, enable the local SSH service and open a reverse SSH tunnel. A reverse tunnel lets an outside party reach a machine from inside a network, which is why security teams treat it as persistence rather than a one-time break-in.
The attack had a built-in limit. Cursor says the SSH step would usually fail on most macOS and Windows machines, because enabling the SSH service requires administrator rights. The company still warns that the tampering may have allowed later credential access, so a failed SSH step does not close the case.
Technical details vary by analysis. CellCog describes a 66-line loader that runs before the legitimate extension code. The extension also reported host details and backdoor status to an attacker server. Threat Landscape lists that server at 134.209.82.225 and says it was reported offline as of Cursor's notice. Cursor describes the beacon as an HTTP POST to a /beacon endpoint on port 8099.
The core facts, as reported, are below.
| Detail | Reported value |
|---|---|
| Malicious version | anthropic.claude-code 2.1.313 |
| Safe version | 2.1.314 |
| Exposure window | About 11 hours, roughly 2:27 a.m. to 1:35 p.m. PT, October 29, 2026 |
| Reported reach | At most 5,000 Cursor users |
| Beacon | HTTP POST to /beacon on port 8099 |
| Reported attacker server | 134.209.82.225, offline as of Cursor's notice per one analysis |
Which Claude Code installs are affected
Cursor says its own marketplace was the only confirmed distribution channel. The company found no evidence that other extension versions or the official distribution were affected, according to BleepingComputer. That is the most reassuring line in the disclosure, and it is also the one the rest of the reporting complicates.
Early reports said npm, Open VSX and Microsoft's marketplace were also affected. Cursor says it was the only source. At least one report says the build was published to Open VSX and mirrored to Cursor, and Help Net Security describes the build as spotted on Open VSX. At least one analysis says copies from other channels were not malicious. Until that conflict is resolved, check the installed version of Claude Code everywhere you run it, not only inside Cursor.
Cursor's response went beyond pulling one build. According to Technology.org, the company shut down its entire VS Code marketplace as a precaution, audited access, rotated keys and rebuilt the marketplace. Unite.AI reports that Cursor said it would contact affected users directly. A full marketplace shutdown suggests the company did not treat this as a single bad file.
How to check your machine and remove the backdoor
Cursor's guidance comes down to a short checklist. Work through it in order, and do not skip the credential step.
- Open Claude Code in Cursor and confirm the version. If it reads 2.1.313, update to 2.1.314, the safe version Cursor named.
- Search for an SSH key labeled svc-telemetry and for any unexpected entries in your authorized_keys file.
- Check whether SSH is switched on at a machine where you never turned it on. Treat that as a red flag.
- Run Cursor's remediation scripts to remove the extension, the planted key, persistence mechanisms and tunnel processes.
- Rotate credentials and sessions reachable from the affected machine, and do that work from a trusted system.
- Remember that uninstalling the extension alone does not remove the backdoor.
If the machine had any chance to allow interactive access, consider rebuilding it. Wiping a host takes more effort than deleting a file, but it removes doubt that a cleanup script cannot fully settle.
Why extension marketplaces make an easy target
Extensions in an IDE often run with deep access to the system. OX Security's analysis of the incident explains why that matters: one poisoned update can write SSH keys or start network tunnels. The attacker borrowed a familiar name, and developers tend to trust an extension that appears to come from the vendor it names.
Cursor is a fork of VS Code, and its marketplace is separate from Microsoft's official VS Code Marketplace. That separation matters here. Developers who assume every listing gets the same vetting as Microsoft's store may not realize the difference, and Cursor is responsible for what its catalog serves.
This is not an isolated pattern. USA 24 has reported on 319 Chrome extensions hijacked in a separate campaign, and on how a vendor breach drained wallets at Polymarket and forced a trading halt. The mechanisms differ, but the lesson is similar: a trusted delivery path became the attack path.
What is still unknown
- How attackers distributed a build under Anthropic's name. Cursor has not explained the path.
- Whether Open VSX carried the build, given the conflicting reports.
- How many of the at most 5,000 users actually ran the malicious code.
- Whether credentials were stolen over the backdoor. Cursor says what it observed was limited but does not rule it out.
- Whether Anthropic has responded. One analysis said Anthropic had published no statement at the time of writing, and this article did not find one.
- Whether the attacker server is still active. One analysis says it was offline as of Cursor's notice.
What to watch next
The open questions will decide how much trust the marketplace can regain. Watch for a published account of how the build passed Cursor's publishing controls, for confirmation or denial from Open VSX, and for a direct statement from Anthropic. Those answers would show whether this was a single publishing lapse or a weakness in how extensions get reviewed.
Expect more reporting on whether the attacker server returns, whether any stolen credentials surface, and whether AI coding tools change how they vet the extensions they recommend.
