For about 11 hours on October 29, 2026, developers who installed or auto-updated Anthropic’s Claude Code extension from the Cursor editor’s extension marketplace got something extra: a tampered build, versions 2.1.312 and 2.1.313 for Windows and macOS, that tried to plant a persistent SSH backdoor. Cursor says the malicious package was live from about 2:27 a.m. to 1:35 p.m. PT, and Socket reports that Cursor put the potential exposure at up to 5,000 users. Microsoft Threat Intelligence has since published a full teardown, and both companies stress the same warning: uninstalling the extension does not remove the backdoor. If your developers use Cursor, here’s what the malware does, how to check for it, and what it means for AI coding tools on your fleet.
What Happened, and What Didn’t
Cursor says the malicious versions “were not developed by Anthropic,” and Microsoft says Anthropic confirmed its systems were not compromised. Microsoft also confirmed the packages were never published to the Visual Studio Marketplace or npm, and Socket found no publication record on Open VSX, correcting early reports that blamed that registry. In Microsoft’s words, “all evidence suggests that the incident is limited to Cursor marketplace.”
Cursor’s response was fast: it pulled the version, shut down the whole marketplace out of caution, audited it and found no other tampered extensions, rotated its keys, rebuilt the marketplace, and worked with the hosting provider to take the attacker’s server offline.
Inside the Backdoor
Microsoft’s analysis shows injected JavaScript that runs before the extension’s normal code, while the extension keeps working so users notice nothing. The loader:
- Profiles the host: hostname, username, OS, architecture, home and working directories, Git email, public IP, and up to 40 environment variable names containing terms like KEY, TOKEN, SECRET, or AWS. Microsoft notes it sent the names, not the values.
- Plants an SSH key: it appends an attacker public key labeled svc-telemetry to the user’s SSH authorized keys file and tries to switch on the local SSH service.
- Opens a reverse tunnel: an outbound SSH connection to 134.209.82[.]225 forwards back to the workstation’s port 22, retrying about every 60 seconds.
- Persists: a LaunchAgent named com.apple.sysmond on macOS, a scheduled task named SysMon on Windows with a Startup-folder fallback, and a cron entry on Linux, all names chosen to look like monitoring tools.
There is some good news. Enabling the SSH service needs admin rights, which the extension lacked on most machines, so Cursor says on those hosts “the attacker could not have logged in through the tunnel.” The key, persistence, and host report still landed, though, so every exposed machine needs cleanup.
How to Check and Clean Up
- Find exposure: identify anyone who installed or updated anthropic.claude-code 2.1.312 or 2.1.313 from Cursor’s marketplace during the October 29 window.
- Check for the key: search SSH authorized keys files, including the Windows administrators file under ProgramData, for svc-telemetry. Cursor publishes one-line checks and remediation scripts for macOS and Windows.
- Hunt in Defender: Microsoft provides advanced hunting queries for connections to the attacker IP, the dropped files, and the SysMon task, plus detections such as “Suspicious addition of an SSH key”.
- Preserve, then remove: collect evidence, isolate hosts with signs of execution, then remove the key, persistence entries, and tunnel processes. Consider a rebuild.
- Rotate secrets: from a clean device, rotate credentials and sessions reachable from affected hosts. Cursor warns that the limited collection “does not rule out later credential access over the backdoor.”
Why It Matters for IT Teams
AI coding assistants are spreading fast, often installed by developers without a ticket in sight, and they run with the user’s full access to source code, cloud keys, and SSH. A single poisoned update in a marketplace that mirrors others was enough to potentially reach thousands of machines in under half a day, with auto-update doing the attacker’s distribution work.
Microsoft’s recommendation is practical: apply Cursor’s security-hardening controls, including restricting extensions to approved publishers and setting an extension installation cooldown so brand-new versions don’t land the minute they’re published.
Looking Ahead
Key questions remain open, including exactly how the tampered build got into Cursor’s marketplace, and the answers will shape how much trust IT teams place in editor marketplaces that repackage other registries. Expect more vendors to add publisher allowlists and update delays as default enterprise settings.
In the meantime, treat developer editors like any other privileged endpoint software: inventory them, manage their extensions through policy, and watch for new SSH keys and unexpected outbound SSH from workstations. That one detection alone would have caught this attack.
Sources:
- Cursor, October 29, 2026 (updated October 30, 2026)
- Microsoft Security Blog, October 30, 2026
- Socket, October 30, 2026
