On 29 October 2026, between roughly 02:27 and 13:35 Pacific Time, a maliciously modified version of Anthropic's Claude Code extension was available in Cursor's VS Code Extension Marketplace. It was live for about eleven hours.
Cursor states the incident affected at most 5,000 users. The tampered build was version 2.1.313, with SecurityWeek also listing 2.1.312. The fix is 2.1.314.
The malicious code attempted to install a persistent SSH backdoor across Windows, macOS and Linux, giving an attacker long-term interactive access to developer machines.
It largely failed, and the reason matters. Because of errors in the attacker's own code, the backdoor installation step would fail outside unusual circumstances where Cursor had been started with administrator privileges.
But "largely" is doing real work in that sentence. The flaw is not a defence on a Mac where Remote Login is already enabled, or where the user enables it later. And uninstalling the extension does not clean the machine.
Anthropic has denied its systems were compromised, and the question of how the tampered package reached the marketplace remains unanswered by either company.
What happened
The attack
Researchers at Phorion and OpenSourceMalware found that the attackers inserted a malicious JavaScript loader at the beginning of the extension's extension.js file, reported as roughly 66 lines, leaving the legitimate extension code otherwise unchanged.
That design is deliberate. The extension continued to work normally. A developer using it would notice nothing.
The payload attempted to establish a persistent SSH reverse backdoor, intended for long-term interactive and automated access to developer laptops and desktops.
Why the extension matters more than most
A code editor extension sits in an unusually valuable position. As one analysis put it, the Claude Code extension sits inside the editor, near source code, terminals, API keys and SSH configuration.
An attacker with persistent access to a developer workstation reaches far more than one machine. They reach repositories, cloud credentials, CI/CD tokens and whatever else that developer can touch. The GhostAction campaign we covered recently depended on exactly this kind of access, obtained earlier by infostealers.
The bug that limited the damage
Cursor's own advisory, echoing Phorion's assessment, confirmed the package contained a critical flaw. Outside highly unusual circumstances where Cursor had been started with administrator privileges, the backdoor installation step would fail.
Do not read that as "nothing happened." Help Net Security reported the counterpoint clearly: the bug is no defence on a Mac with Remote Login already enabled, or one where the user turns it on later. For those machines, the backdoor is ready to use.
Separate analysis also describes the payload attempting to exfiltrate credentials, SSH keys and system data, which is a different objective from the SSH backdoor and would not necessarily be blocked by the same error.
Uninstalling is not enough
This is the most important practical point in the whole incident.
Cursor's advisory states that "Uninstalling the extension may not be sufficient", because the payload drops standalone persistence scripts that keep running independently of the extension.
Anyone who installed 2.1.312 or 2.1.313 and then simply removed the extension has not finished the job.
What Cursor did
Cursor removed the malicious extension immediately on identifying it, then suspended its entire marketplace to investigate. It audited access, found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.
That is a strong response. Taking down a whole marketplace is expensive and disruptive, and doing it quickly is the right instinct when you do not yet know the scope.
The unresolved question
Here is what has not been explained.
Anthropic's position, given in a statement, is that "a malicious actor used access to Cursor's marketplace to publish a tampered extension", and that it was not involved in building, publishing or hosting it. Cursor, for its part, stated the malicious version was not developed by Anthropic and that it has no evidence other versions or the official distribution were affected.
Neither company has explained how the tampered package reached the marketplace under Anthropic's publisher identity. The Register noted this gap directly. One security analysis speculates stolen publisher credentials, likely stored access tokens, but that is an inference rather than a confirmed finding.
So two companies have each said what did not happen on their side, and the actual mechanism remains publicly unknown.
Why it matters
Developer workstations are the highest-value endpoint in most organisations. They hold credentials with production reach, repository write access and cloud tokens. Compromising one developer is worth more than compromising fifty ordinary users.
Marketplace trust is the attack surface. The extension carried Anthropic's publisher name in Cursor's own marketplace, and it auto-updated. There was no decision for the developer to make, no suspicious download, nothing to inspect. Trust in the publisher identity was the entire mechanism.
Eleven hours is short, and still reached up to 5,000 machines. That is the throughput of an auto-updating distribution channel. Detection speed matters enormously here, and Cursor's was good by any reasonable standard.
We got lucky, and luck is not a control. The attacker's code was broken. If it had worked, this would be a story about thousands of compromised developer machines with persistent SSH access, and through them an unknown number of downstream organisations.
Fragmented marketplaces create uneven security. Microsoft's Visual Studio Marketplace terms restrict it to Microsoft's own products, so VS Code forks like Cursor and Windsurf rely on Open VSX or their own stores. That fragmentation means extension security now varies by which editor you choose.
Who is affected
Cursor users who installed or auto-updated to Claude Code extension versions 2.1.312 or 2.1.313 on 29 October, up to 5,000 people.
Among those, anyone running macOS with Remote Login enabled, for whom the attacker's bug offered no protection.
Organisations employing those developers, through whatever credentials and repository access sat on the affected machines.
Users of other VS Code forks relying on third-party marketplaces, as a category rather than through this specific incident.
Not affected: users of the official Anthropic distribution channels, and VS Code users on Microsoft's Visual Studio Marketplace, where no malicious version has been reported.
What to do
If you use Cursor
Check which version of the Claude Code extension you have. If it is 2.1.312 or 2.1.313, treat the machine as potentially compromised.
Update to 2.1.314 or later.
Do not stop at uninstalling. The payload drops standalone persistence scripts that survive removal of the extension.
Check for unauthorised SSH access specifically. Review
~/.ssh/authorized_keysfor keys you did not add, check SSH daemon configuration, and on macOS check whether Remote Login was enabled without your knowledge.Look for unexpected scheduled tasks, launch agents or cron jobs created around 29 October.
If you find anything, rebuild the machine. A developer workstation with a persistent backdoor is not a cleanup job.
Rotate, on the assumption that credentials were read
Rotate SSH keys, API keys, cloud credentials and personal access tokens that were present on the machine. Analysis indicates the payload also targeted credentials and SSH keys, which the backdoor bug would not necessarily prevent.
Revoke sessions as well as changing passwords, since tokens already issued keep working.
Review repository and CI/CD activity from the affected machine since 29 October.
Structurally
Inventory which extensions your developers run and from which marketplace. Most organisations have no visibility here at all.
Consider disabling extension auto-update in editors where that is practical, accepting the trade-off against missing security fixes.
Treat developer endpoints as privileged systems in your monitoring, not as ordinary user laptops.
Watch for processes spawned by editor extensions, which is the behavioural signal this class of attack produces.
Final thoughts
A tampered extension carrying a trusted publisher's name sat in an official marketplace for eleven hours, auto-updated onto up to 5,000 developer machines, and tried to install a permanent SSH backdoor. It mostly did not work, because the attacker made mistakes.
The lesson: extension marketplaces are an auto-updating code execution channel pointed directly at your most privileged endpoints, and almost nobody governs them. Organisations that carefully review which software goes on a server will let a developer install any extension that appears in their editor's store, from a publisher they have never evaluated, updating silently. The trust decision was made once, at install time, and then delegated permanently.
The second lesson is less comfortable and worth stating plainly. The outcome here was determined by the attacker's incompetence rather than by anyone's defences. A working payload would have produced thousands of backdoored developer machines, and the path from there into employers' repositories and cloud accounts is short. Treating this as a near miss that was handled well is half right. It was handled well after detection. It was not prevented.
Two questions worth answering this week: which extensions are installed across your development team and where did they come from, and would you notice if one of them started an SSH daemon?
