For about eleven hours on October 29, 2026, Cursor’s own extension marketplace handed developers a trojan. In a security notice published that day and updated on October 30, Cursor said “a maliciously modified version of Anthropic’s Claude Code extension” — Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS — was available in the Cursor VS Code Extension Marketplace from about 2:27 a.m. to 1:35 p.m. PT. “These malicious versions of the extension were not developed by Anthropic.”
Quick Take
- What: Tampered Claude Code extension builds 2.1.312 and 2.1.313, served from Cursor’s marketplace, not from Anthropic’s official distribution.
- Window: About 2:27 a.m. to 1:35 p.m. PT on October 29, 2026.
- Payload: Collects host and user details and tries to install a persistent SSH backdoor, including an authorized-keys entry labeled
svc-telemetry, a LaunchAgent or scheduled task, and a reverse tunnel to an attacker server. Cursor later had that server taken offline. - Scale: The Verge reported that Cursor said around 5,000 people may have installed the malicious extension.
- Check: Search
~/.ssh/authorized_keys(and the Windows equivalents) forsvc-telemetry. Uninstalling the extension is not enough; the payload drops standalone persistence.
What the malware tried to do
Cursor’s notice is unusually detailed. The extension collected hostname, username, OS, architecture, home directory, environment-variable names, working directories, configured Git email, and public IP, and reported them to the attacker. It tried to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel, then persist that tunnel with a macOS LaunchAgent (com.apple.sysmond) or a Windows scheduled task named SysMon, retrying about every 60 seconds.
Cursor also says the most damaging step often failed: turning on the local SSH service needs administrator rights, which the extension does not have on most Mac and Windows hosts. “On those hosts the step fails and the attacker could not have logged in through the tunnel.” That is not a clean bill of health. Cursor is clear that the extension still added the attacker’s SSH key, installed persistence, and sent host details, and it tells everyone in the window to follow the remediation steps anyway.
Cursor removed the builds, shut the marketplace down “out of an abundance of caution,” audited other extensions (it says it found no other tampering), rotated keys, rebuilt the marketplace, and worked with the attacker’s hosting provider to take the command-and-control server offline. Official Anthropic distribution and, by later reporting, other marketplaces were not the source of these builds.
What you should do
If you installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace in that window:
- Run Cursor’s check for the
svc-telemetrykey, then its remediation scripts (macOS as the affected user, Windows as Administrator). The scripts remove the extension, persistence, tunnel processes, and the key. - Isolate any host with evidence of payload execution. Uninstalling the extension alone may leave
~/.config/.smt, LaunchAgents, scheduled tasks, or startup scripts in place. - Rotate credentials and sessions that could be reached from an affected host, from a clean machine.
Cursor published indicators of compromise, including VSIX hashes for both versions and platforms, the attacker address 134.209.82.225, and the svc-telemetry key fingerprint. Microsoft October 30 analysis covers the same incident in more technical depth.
What it means
This was a marketplace compromise, not a bug in Claude Code’s upstream source. For developers, the lesson is brutal and familiar: the channel you use to install an official-looking editor extension is part of your trusted computing base. For Cursor, the eleven-hour window and the reported affected-user count make this one of the most serious AI-tool supply-chain incidents of the autumn. Even where the reverse-login step failed, key theft and persistence are enough to treat a hit machine as an incident, not a close call.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on Cursor’s October 29–30 security notice, The Verge’s report of Cursor’s affected-user figure, and Microsoft’s October 30 technical blog. i10x did not analyze the VSIX files.
