Malicious Claude Code extension in Cursor's marketplace hit up to 5,000 users

A tampered build of Anthropic's Claude Code extension sat in Cursor's VS Code extension marketplace for about eleven hours on 29 October, Cursor says [1]. The package, Anthropic.claude-code 2.1.313, tried to install an SSH backdoor; at most 5,000 users were affected, and Cursor says Anthropic did not develop it [1].

What did the malicious Claude Code extension do?

A tampered Claude Code extension in Cursor's marketplace reached at most 5,000 users, Cursor says. It was available between about 2:27am and 1:35pm Pacific time on 29 October, and Cursor says it will contact those users directly [1].

The malicious version tries to plant an attacker's SSH key and a reverse SSH tunnel on developer machines. According to Cursor, it collects the hostname, username, operating system, home directory, environment variable names, working directories, Git email and public IP, and reports them to a server on port 8099 [1].

It also tries to stay on the machine: through a LaunchAgent called com.apple.sysmond on macOS, and a scheduled task called SysMon on Windows [1]. Cursor says the step that turns on the local SSH service needs admin rights and fails on most macOS and Windows hosts because of errors in the malicious code; the SSH key, the persistence and the data upload still happen [1].

How did Cursor respond?

Cursor says it removed the version, then shut down its whole extension marketplace as a precaution [1]. It audited access, found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back online [1]. The attacker's server was taken offline with the cloud provider hosting it [1].

In a post on X, Cursor said the incident does not affect other extensions in its marketplace and asked all customers to update Claude Code for VS Code to version 2.1.314 [2].

What should Cursor users do now?

Cursor says uninstalling may not be enough and asks users to check for the svc-telemetry key. The extension adds an attacker key labelled svc-telemetry to the SSH authorized_keys file; Cursor publishes a one-line check for macOS and Windows and remediation scripts on its notice [1].

Cursor also advises isolating hosts that show signs of the payload and rotating credentials and sessions reachable from affected machines, from a trusted system [1].

Our read

Opinion: Coding agents run with the same access as the developer, so an extension marketplace is now a high-value target. Cursor's fast shutdown and detailed indicators are the right playbook, but the missing piece is how the package got in; until that is explained, teams should pin extension versions and watch their SSH keys.

What we could not verify

• How the attacker got the modified package into Cursor's marketplace; Cursor's notice does not say.
• Whether Anthropic has commented; we found no statement on Anthropic's newsroom or on the @AnthropicAI and @claudeai accounts on X as of 30 October 2026, 14:30 CET.
• How many of the up to 5,000 affected users actually ran the payload, and on how many machines the attacker's SSH key or persistence was installed.
• Whether the official VS Code Marketplace or Open VSX were affected; Cursor says it has no evidence that other versions of the extension or the official distribution are affected, but it has not published an independent check.