A tampered Claude Code extension reached Cursor users for 11 hours. Here is how to check your machine.

For about 11 hours on October 29, anyone who installed or updated Anthropic's Claude Code extension inside Cursor could have received a tampered build that tries to plant a persistent SSH backdoor. Cursor published a security notice the same day, pulled the build and shut down its whole extension marketplace while it rotated keys. Cursor said at most 5,000 users were affected and that it is contacting them directly, according to Help Net Security and Socket.

Current evidence limits the problem to Cursor's marketplace. The Claude Code npm package and the extension in Microsoft's Visual Studio Marketplace were not affected, according to Microsoft. If you run Claude Code in VS Code or in a terminal, you have nothing to clean up. If you run it in Cursor, check your machine even if you have already updated.

What is confirmed

These details come from Cursor's notice, which it updated on October 30 at 11:30 am PT, and from Microsoft's analysis of the payload, published October 30.

• Window: the malicious build was available from about 2:27 am to 1:35 pm PT on October 29, 2026 (5:27 am to 4:35 pm ET).
• Versions: Cursor lists the builds of Anthropic.claude-code 2.1.312 and 2.1.313 that its marketplace served for Windows and macOS, and says they "were not developed by Anthropic." Early reports named only 2.1.313; Cursor added 2.1.312 in its October 30 update and published file hashes for both.
• How it runs: a JavaScript loader was added to the start of the extension's extension.js file. It runs as soon as the editor loads the extension, so you did not have to open Claude Code for it to fire.
• What it collects: hostname, username, operating system, home and working directories, Git email, public IP, and the names (not the values) of up to 40 environment variables that look like keys, tokens or cloud credentials.
• What it tries to do: add an attacker SSH key labeled svc-telemetry to authorized_keys, switch on the local SSH service and open a reverse SSH tunnel to 134.209.82.225, retrying about every 60 seconds.
• Persistence: a LaunchAgent named com.apple.sysmond on macOS, a scheduled task named SysMon with a Startup-folder fallback on Windows, and a cron @reboot entry on Linux.
• Containment: Cursor removed the build, audited access, found no other tampered extensions, brought the marketplace back online and worked with the hosting provider to take the attacker's server offline.

Microsoft says the malicious packages "were never published nor distributed from Microsoft Visual Studio Marketplace" and that Anthropic confirmed to Microsoft that its own systems were not compromised. Anthropic published version 2.1.314 to npm at 00:12 UTC on October 30, according to Socket.

What is reported or still unknown

• How the attacker got in: nobody has said. Researcher Kevin Beaumont and Phorion co-founder Luke Roberts both said the build was posted through Anthropic's official publisher account on Cursor, according to Ars Technica. Cursor's notice gives no root cause.
• Whether the backdoor worked: Phorion found bugs that stop the SSH step on many machines. On macOS, the check for Remote Login fails without admin rights, so SSH is never switched on. Cursor says the key, persistence and host reporting could still succeed, and Phorion warns the backdoor becomes usable if Remote Login is already on or is turned on later.
• Anthropic's public response: as of October 31 we could not find a customer notice from Anthropic. Ars reported on October 30 that neither Anthropic nor Cursor had answered its questions about the cause.
• Open VSX: the first reports said the build came from Open VSX. Phorion corrected its advisory to name Cursor's marketplace, and Socket found no publication event for 2.1.313 in the Open VSX change feed.

"It was a supply-chain compromise where the attacker gained access to the official distribution channel." - Luke Roberts, Phorion, via Ars Technica

What to check if you use Claude Code in Cursor

• Look for the key: on macOS or Linux, search ~/.ssh/authorized_keys for svc-telemetry. On Windows, check %USERPROFILE%\.ssh\authorized_keys and, per Microsoft, C:\ProgramData\ssh\administrators_authorized_keys.
• Look for the persistence files: ~/Library/LaunchAgents/com.apple.sysmond.plist, ~/.config/.smt and ~/.config/.smtk on macOS; a SysMon scheduled task or a sysmon.cmd file in the Startup folder on Windows; hidden .stk_ files in your temp folder.
• Do not stop at uninstalling: Cursor says the payload drops standalone scripts that keep running after the extension is removed, and updating to 2.1.314 does not remove them. Cursor's notice includes cleanup scripts for macOS and Windows.
• Rotate secrets if anything turns up: the beacon sent only variable names, but those names tell an attacker which cloud and API keys sit on the machine. Rotate them from a different, trusted device, and consider rebuilding the machine.

What this means for you

This was not a bug in Claude Code. It was a failure in how Cursor distributes extensions. Cursor runs its own marketplace, separate from Microsoft's, and Roberts told Ars that extensions there auto-update by default. That is how one bad build could reach up to 5,000 users within a single working day.

• If you run Cursor for a team: Cursor's extension settings let team owners and admins set an install cooldown in hours, limit installs to approved publishers or extension IDs, and, on Enterprise, require Open VSX signatures. The cooldown is 0, meaning off, by default. With a 24-hour cooldown, this build would have been pulled before it could install.
• If you use Cursor on your own: you can set extensions.installCooldownHours in your settings when your team has not enforced one.
• If you want fewer layers: Claude Code also runs in the terminal and as a desktop app, neither of which depends on an editor marketplace. Our Claude Code vs Cursor comparison covers how the two tools differ.
• If you are choosing between editors: ask where each one gets its extensions and who can publish to that store. VS Code users pulling from Microsoft's marketplace were not exposed here.

AI coding extensions run with your editor's permissions, can read your source code and often sit next to cloud credentials. Treat them like any other dependency: delay updates where you can, know which store each one comes from, and keep an eye on the vendor's security notices.

Sources: Cursor security notice, Microsoft Security blog, Phorion advisory, Socket, Ars Technica, BleepingComputer, Help Net Security.