Tampered builds of Anthropic's Claude Code extension were served through Cursor's VS Code Extension Marketplace on October 29, 2026, and tried to plant an SSH backdoor on Mac and Windows machines. Cursor's security notice names "Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS" and says "These malicious versions of the extension were not developed by Anthropic." Cursor took them down, rebuilt its marketplace and published a check, cleanup steps and indicators of compromise. Microsoft Threat Intelligence published its own analysis of the builds on October 30, 2026.

#What should you do?

Cursor says to act "If you installed or updated to Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code Extension Marketplace on macOS or Windows between 2:27am PT and 1:35pm PT on October 29, 2026."

  1. Check your machine. Use Cursor's check for macOS and Windows. It looks for an SSH key labeled svc-telemetry. Cursor says: "If the key is found, your machine is impacted."
  2. Search your logs. Cursor says to search "across endpoint, network, and extension-installation telemetry" for its indicators of compromise.
  3. Isolate affected hosts. "Isolate hosts showing evidence of payload execution or backdoor installation."
  4. Clean up. Run Cursor's cleanup script for your platform. Cursor says "These scripts remove the malicious extension, the persistence mechanisms, the running tunnel processes, and the attacker's SSH key." It also says to "assess whether the host should be rebuilt."
  5. Rotate credentials. "Rotate credentials and sessions accessible from affected hosts, from a trusted system."

Do not stop at removing the extension. Cursor warns: "Uninstalling the extension may not be sufficient." Its reason is that "the payload drops standalone persistence scripts that keep running." Cursor's full five steps are here. Questions go to security@cursor.com, it says.

#What did the malicious builds do?

Cursor says "The extension runs malicious code that attempts to install a persistent SSH backdoor." At a high level, it:

  • Collected details. It "Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP."
  • Tried to open a way in. It "Attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel."
  • Tried to persist. It used a LaunchAgent on macOS, or a scheduled task with a Startup-script fallback on Windows. "Background scripts retry the tunnel roughly every 60 seconds."

Cursor says the login step mostly failed: "Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail." On most hosts, "the attacker could not have logged in through the tunnel." But that is not the whole picture. "The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker. Follow the remediation steps below regardless."

Cursor also says "The limited env-var collection does not rule out later credential access over the backdoor." Ars Technica reported that "Phorion said the theft of variable names allowed the operator to quickly take inventory of cloud credentials and API tokens stored on a compromised device."

Indicator names in Cursor's list include the key comment svc-telemetry, a macOS LaunchAgent labeled com.apple.sysmond, and a Windows scheduled task named SysMon with a sysmon.cmd Startup fallback. Cursor's notice has the full list, including file hashes and the attacker's address, which it gives as 134[.]209[.]82[.]225.

#How many people were affected?

Cursor's notice does not give a number. Ars Technica reported that "The malicious version, 2.1.313, subsequently affected “at most 5,000 users,”" and that the extension "threatened as many as 5,000 developers’ machines." Ars also quoted Phorion's Luke Roberts: "Extensions auto-update in Cursor by default, but users can configure this in settings."

#Which versions, and what about 2.1.314?

The sources differ. Cursor's notice lists 2.1.312 and 2.1.313. On October 30, 2026 at 11:30 am PT, Cursor updated the notice: "We updated the IOCs and clarified affected versions." Ars Technica named 2.1.313 as the malicious version and reported that "Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont."

Anthropic's GitHub releases go from v2.1.312, a normal release dated October 27, 2026, to v2.1.314, with no v2.1.313. Its changelog does the same. Neither mentions the incident. Updating the extension does not by itself remove what the payload installed, per Cursor's warning above.

#What did Cursor do?

Cursor says it "Removed the malicious version from the Cursor VS Code Extension Marketplace immediately upon detection and blocked further distribution." It then did "a full shut down of the marketplace out of an abundance of caution." Cursor says: "We audited access and confirmed no other extensions were tampered with." It adds: "We rotated our keys, rebuilt the marketplace, and brought it back online."

The attacker's server is down. "Note: The attacker server no longer functions," Cursor says, after it worked with the hosting provider to take it offline. Cursor says it has "no evidence that other versions of the extension or the official distribution are affected."

#How did the builds get there?

That is not explained. Ars Technica reported that Beaumont and Phorion's CTO "said that version 2.1.313 was distributed through Anthropic’s official account on Cursor." Ars added: "So far, neither Cursor nor Anthropic has explained how the attackers gained control of the account."

Microsoft says it confirmed that the malicious packages were never published or distributed through Microsoft's Visual Studio Marketplace or npm. It adds: "At this time, all evidence suggests that the incident is limited to Cursor marketplace."

Anthropic told Microsoft that its systems were not compromised and that it did not develop the malicious package, according to Microsoft's analysis: "Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace." Anthropic has not published its own statement on the incident. Felix Rieseberg of Anthropic said in a post on X that it "wasn’t a compromise of Anthropic’s systems or employee laptops".

For a similar case, see our coverage of the LiteLLM 1.107.0 supply-chain compromise. To limit what coding tools can reach, see our guide to controlling AI coding agent network access on a Mac.

Our analysis: Extensions for AI coding tools run with broad access to a developer's machine, and auto-updates mean a bad build can spread without anyone clicking install. Cursor's notice is detailed and its fixes are concrete, but the key question is open: how a tampered build appeared under Anthropic's name. Until Cursor or Anthropic explains that, developers should treat extension updates as something to watch, not just accept.

#What is still unclear?

  • Access. How the malicious builds reached Cursor's marketplace.
  • Versions. Why Cursor lists 2.1.312 when Anthropic's GitHub 2.1.312 is a normal release.
  • Impact. How many machines had the key or persistence installed.