← All incidents

Cursor says malicious Claude Code extension builds 2.1.312 and 2.1.313, not developed by Anthropic, were in its VS Code extension marketplace on Oct 29 and tried to plant an SSH backdoor

Incident · Cursor VS Code Extension Marketplace: Anthropic.claude-code 2.1.312 and 2.1.313 for macOS and Windows (malicious, not developed by Anthropic, per Cursor) · HIGH

Summary

Cursor says malicious builds of Anthropic's Claude Code extension, Anthropic.claude-code "version 2.1.312 and 2.1.313 for Windows and MacOS", were in the Cursor VS Code Extension Marketplace on Oct 29, 2026. It says anyone who installed or updated to either version from that marketplace on macOS or Windows between 5:27 a.m. and 4:35 p.m. ET on Oct 29 ("between 2:27am PT and 1:35pm PT on October 29, 2026") should check their machine. Cursor says "These malicious versions of the extension were not developed by Anthropic." Its notice is dated Oct 29 and now ends: "Update: Oct 30, 2026, 11:30 am PT: We updated the IOCs and clarified affected versions." Cursor's original notice named only 2.1.313 and said "At most 5,000 users were affected, and we will reach out directly." The updated notice no longer gives a figure. Per Cursor, the extension collects and reports host and user information, adds an attacker-controlled SSH key, sets up persistence and tries to open a reverse SSH tunnel. Cursor says "turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker's SSH key, installed persistence, and sent host details to the attacker." Cursor says it removed the malicious version, shut down and rebuilt its marketplace, rotated its keys, confirmed no other extensions were tampered with, and worked with the hosting provider to take the attacker's server offline. It says "We have no evidence that other versions of the extension or the official distribution are affected." Cursor has not said how the malicious builds got into its marketplace. Anthropic says its own systems were not compromised. Felix Rieseberg, whose X profile reads "I build things @AnthropicAI", wrote on Oct 30 that "it wasn't a compromise of Anthropic's systems or employee laptops" and that the tampered copy was one "which we didn't build or publish." Microsoft's Security Blog says "Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace" and "At this time, all evidence suggests that the incident is limited to Cursor marketplace."

Severity

Timeline

1. Oct 29, 2026, about 5:27 a.m. ET (2:27 a.m. PT)
   Start of the window Cursor gives. Per Cursor, "a maliciously modified version of Anthropic's Claude Code extension was made available in the Cursor VS Code Extension Marketplace" from about this time; its updated notice names versions 2.1.312 and 2.1.313 for Windows and macOS.
2. Oct 29, 2026, about 4:35 p.m. ET (1:35 p.m. PT)
   End of the window Cursor gives. Cursor says it removed the malicious version from the marketplace "immediately upon detection", blocked further distribution, then shut down the marketplace "out of an abundance of caution".
3. Oct 29, 2026, 5:38 p.m. ET
   Cursor's status page opens an incident titled "Investigating Service Degradation with VS Code Extensions". It does not mention security, and Cursor has not said whether it is related to this incident.
4. Oct 29, 2026 (date on the notice; publish time not given)
   Cursor's security notice, dated Oct 29, is published with indicators of compromise, a check for the attacker's SSH key and remediation scripts for macOS and Windows. The page gives no publish time; Cursor's X post linked to it at 3:46 a.m. ET on Oct 30. That first version named only 2.1.313 and said "At most 5,000 users were affected, and we will reach out directly."
5. Oct 29, 2026, 8:12 p.m. to 9:20 p.m. ET
   Claude Code 2.1.314 appears on npm (8:12 p.m. ET), Open VSX (9:07 p.m. ET) and the Microsoft VS Code Marketplace (9:16 to 9:20 p.m. ET), per those registries' records. None of the three lists a version 2.1.313.
6. Oct 30, 2026, 3:12 a.m. ET
   Cursor's status page marks the VS Code extensions incident resolved: "All services have returned to normal operation." It does not mention security, and Cursor has not said whether it is related to this incident.
7. Oct 30, 2026, 3:46 a.m. ET
   Cursor posts on X that it "took down our extension marketplace this afternoon" and reinstated it "after confirming there is no further risk", and asks all customers to update to Claude Code for VS Code version 2.1.314.
8. Oct 30, 2026, 3:50 a.m. ET
   Cursor co-founder Michael Truell replies on X to a post that is no longer available: "We've spoken with the author of this blog and do not believe the official Claude Code VS Code extension was compromised. We believe this is instead a report of this incident."
9. Oct 30, 2026, about 4:30 a.m. ET
   Reuters reports Cursor's statement and that Anthropic "did not immediately respond to a request for comment".
10. Oct 30, 2026, 10:08 a.m. ET
    Felix Rieseberg, whose X profile reads "I build things @AnthropicAI", posts on X: "We're working with Cursor on this incident, but it wasn't a compromise of Anthropic's systems or employee laptops. A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected and this only impacts Cursor users."
11. Oct 30, 2026, 2:30 p.m. ET (11:30 a.m. PT, per the notice)
    Cursor updates its notice: "Update: Oct 30, 2026, 11:30 am PT: We updated the IOCs and clarified affected versions." The updated notice names 2.1.312 and 2.1.313 for Windows and macOS, lists separate file hashes for each version, adds a hash for the modified extension.js and Linux file paths to its indicators, and no longer gives a number of affected users.
12. Oct 30, 2026, 9:02 p.m. ET
    Microsoft publishes an analysis on the Microsoft Security Blog, under the byline Microsoft Security Research. It says "Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace," that it has "confirmed that the malicious packages found on Cursor marketplace were never published nor distributed from Microsoft Visual Studio Marketplace" or npm, and that "At this time, all evidence suggests that the incident is limited to Cursor marketplace."

How it happened

Cursor says malicious builds were published in its own VS Code extension marketplace under the Claude Code extension's name, Anthropic.claude-code, as versions 2.1.312 and 2.1.313 for Windows and macOS. It has not said how they got there, and The Hacker News reports that the method "remains unclear." Per Cursor, the extension "runs malicious code that attempts to install a persistent SSH backdoor." It collects and reports the hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email and public IP. It appends an attacker-controlled public key labeled svc-telemetry to the user's SSH authorized keys, tries to enable the local SSH service and to open a reverse SSH tunnel to the attacker's server, and tries to make the tunnel persistent with a LaunchAgent on macOS or a scheduled task named SysMon on Windows, with background scripts retrying the tunnel "roughly every 60 seconds." Cursor's indicators list an HTTP POST beacon to /beacon on port 8099. Of the step that adds the key, enables the SSH service and opens the tunnel, Cursor says "Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail," and it also says "The extension added the attacker's SSH key, installed persistence, and sent host details to the attacker." Cursor says the attacker's server "no longer functions" because it worked with the cloud provider hosting it to take it offline. Cursor's updated indicators list modified packages of both versions for macOS on Apple silicon (darwin-arm64) and Windows (win32-x64), a hash for the modified extension.js, and file paths for Linux as well as macOS and Windows, although the notice names only Windows and macOS as affected. OpenSourceMalware's own write-up says the package's main JavaScript bundle "contains a malicious 66-line loader inserted before the legitimate extension code." Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News the same and that "anyone who has their Claude Code instance set to auto-update could have consumed the malware." Cursor says "These malicious versions of the extension were not developed by Anthropic." Anthropic's own registry listings do not include a 2.1.313: on npm, the release record for the Claude Code command-line package, whose recent version numbers match the extension's on the Microsoft VS Code Marketplace, goes from 2.1.312 (Oct 27) to 2.1.314 (Oct 29, 8:12 p.m. ET), and the Microsoft VS Code Marketplace and Open VSX listings we checked on Oct 30 list 2.1.312 and 2.1.314 but no 2.1.313. Those 2.1.312 listings are Anthropic's releases on other registries. Cursor says the 2.1.312 and 2.1.313 builds in its own marketplace were malicious, so a 2.1.312 listed elsewhere does not mean the 2.1.312 from Cursor's marketplace was safe. An earlier version of The Hacker News story said the extension on Open VSX was compromised; the outlet has since corrected it to say the incident was traced to Cursor's marketplace.

How to check your app

• Work out whether you are in scope. Cursor says this applies if you installed or updated to 2.1.312 or 2.1.313 from its marketplace on macOS or Windows between 5:27 a.m. and 4:35 p.m. ET on Oct 29. Its words: "If you installed or updated to Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code Extension Marketplace on macOS or Windows between 2:27am PT and 1:35pm PT on October 29, 2026". We suggest checking the Claude Code extension's installed version in Cursor. Cursor's updated notice no longer lists extension folder names; it says extension.js "in package versions 2.1.312 and 2.1.313 for both Darwin and Windows" contains the attacker's IP address and svc-telemetry.
• Run Cursor's check for the attacker's SSH key, copied from Cursor's notice. On macOS it is a one-line grep that looks for svc-telemetry in ~/.ssh/authorized_keys; on Windows it is a two-line PowerShell check that also looks in C:\ProgramData\ssh\administrators_authorized_keys. Each prints "svc-telemetry key found" or "No key found; machine not impacted". Cursor says: "If the key is found, your machine is impacted."
• If the key is there, Cursor says to isolate the host, then remove the SSH key, the persistence and the running tunnel processes with its remediation scripts, and assess whether the host should be rebuilt. On macOS, it says to run remediate-macos.sh as the affected user, not as root; on Windows, run remediate-windows.ps1 from PowerShell opened with Run as Administrator. Cursor warns that uninstalling the extension "may not be sufficient" because the payload drops standalone persistence scripts that keep running.
• Rotate credentials and sessions that could be reached from an affected host, and do it "from a trusted system", as Cursor advises. Cursor says "The limited env-var collection does not rule out later credential access over the backdoor."
• For teams, Cursor says to search endpoint, network and extension-installation telemetry for its indicators. They include the attacker endpoint 134[.]209[.]82[.]225 (reverse SSH on TCP 22 and HTTP POST to /beacon on port 8099), the key comment svc-telemetry, the macOS LaunchAgent com.apple.sysmond, the Windows scheduled task SysMon and, on Linux, a cron @reboot entry. Cursor updated its indicators on Oct 30. The full list, with separate file hashes for 2.1.312 and 2.1.313 and a hash for the modified extension.js, is in Cursor's notice. If you matched file hashes from the original notice, we suggest checking again against the updated list: the original notice's macOS package hash is no longer in it.
• Update the extension to 2.1.314, the version Cursor asked all customers to install in its Oct 30 X post. Cursor's notice says "We have no evidence that other versions of the extension or the official distribution are affected."

Sources

• Cursor: Security notice, malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace (dated Oct 29, 2026; updated Oct 30, 11:30 a.m. PT). Primary source
• Cursor's original security notice, naming only 2.1.313 (Internet Archive copy, Oct 30, 2026, 7:44 a.m. ET)
• Cursor (@cursor_ai) on X: incident statement (Oct 30, 2026, 3:46 a.m. ET)
• Michael Truell (@mntruell) on X: reply (Oct 30, 2026, 3:50 a.m. ET)
• Cursor status page: Investigating Service Degradation with VS Code Extensions (Oct 29 to 30, 2026)
• The Hacker News: Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor (Oct 30, 2026)
• OpenSourceMalware: Trojanized Claude Code Extension Plants an SSH Backdoor (Oct 30, 2026)
• Reuters via TradingView: Cursor says up to 5,000 users affected by tampered Claude Code extension (Oct 30, 2026)
• npm registry record for @anthropic-ai/claude-code (version list and publish times)
• Open VSX: Anthropic/claude-code (version list)
• Microsoft VS Code Marketplace: Claude Code for VS Code
• Microsoft Security Blog (Microsoft Security Research): Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (Oct 30, 2026)
• Felix Rieseberg (@felixrieseberg) on X: post on the incident (Oct 30, 2026, 10:08 a.m. ET)

Corrections and updates

1. Oct 30, 2026
   Updated at 6:02 p.m. ET after Cursor updated its notice (Oct 30, 11:30 a.m. PT). Cursor now names two malicious versions, 2.1.312 and 2.1.313, for Windows and macOS, not only 2.1.313, and has changed its indicators of compromise. The updated notice no longer says how many users were affected. We had quoted "At most 5,000 users were affected, and we will reach out directly." as Cursor's current words; it is now attributed to the original notice. We also reworded the registry check so it no longer reads as if 2.1.312 were safe, and now give times in ET first.
2. Oct 31, 2026
   Updated at 10:34 a.m. ET on Oct 31 to add Anthropic's statement. We had written that we found no public statement from Anthropic as of 8:41 a.m. ET on Oct 30. Later that day Felix Rieseberg, whose X profile reads "I build things @AnthropicAI", said on X that "it wasn't a compromise of Anthropic's systems or employee laptops," and Microsoft's Security Blog says Anthropic confirmed to Microsoft that its systems were not compromised. Both are now cited.