A tampered build of Anthropic’s Claude Code extension sat inside Cursor’s extension marketplace for roughly eleven hours on October 29, and as many as 5,000 developers may have downloaded it. The rogue package did not come from Anthropic’s build pipeline; it was a modified copy published through the editor vendor’s store, and it tried to install an SSH backdoor on affected machines. The episode is less a story about AI coding assistants than about the trust assumptions baked into third-party extension marketplaces.
- Exposure window: Versions 2.1.312 and 2.1.313 for Windows and macOS were live from about 2:27 a.m. to 1:35 p.m. Pacific on October 29.
- Payload behavior: The injected code harvested host metadata, added an attacker-controlled SSH key labeled svc-telemetry, and attempted reverse tunnels with persistence scripts.
- Scope: Anthropic says its systems and employees’ laptops were not compromised; Microsoft’s Visual Studio Marketplace and the official npm package were reported clean.
What the malicious build actually did
According to Cursor’s security notice and independent analysis by Microsoft Threat Intelligence, the tampered package matched the legitimate Claude Code extension except for a loader prepended to extension.js. That loader executed as the editor loaded the module, before the expected initialization code ran, so simply having the extension installed was enough to trigger it. No Claude conversation was required.
The code collected hostnames, usernames, operating system details, working directories, configured Git emails and public IP addresses. It then tried to write an Ed25519 key commented svc-telemetry into the SSH authorized keys file, enable the local SSH service, and open a reverse tunnel back to attacker infrastructure. On macOS it registered a LaunchAgent; on Windows it created a scheduled task. Nearly every exception in the loader was suppressed so the legitimate extension could keep working, which helped the compromise stay quiet.
Cursor stresses that the SSH-service step required administrator privileges the extension typically lacks, so the full remote-access chain would have failed on most systems. Microsoft, however, cautions that the key insertion and persistence artifacts could still be written even when a tunnel never succeeded. Uninstalling the extension may not be enough, because startup scripts and retry loops can live outside the extension directory.
How the attack got into the store
The most consequential unanswered question is how the attacker obtained publishing access. Reporting points to abuse of a publisher token tied to the extension’s marketplace account, allowing a malicious update to be pushed under Anthropic’s branding. Cursor has not publicly detailed the initial access vector. The company removed the affected versions, temporarily shut down and rebuilt its marketplace, audited other extensions, rotated keys, and worked with a hosting provider to take the command-and-control server offline.
There is a discrepancy worth noting: early accounts attributed the bad build to a copy of the Open VSX registry, while Cursor later told researchers the package came from its own mirror of that registry rather than Open VSX itself. The official npm package and Microsoft’s marketplace listing were reported clean throughout.
Anthropic’s technical team stated that there was no compromise of Anthropic systems or employees’ laptops, that a malicious actor used access to Cursor’s store to publish the tampered copy, and that Anthropic’s official channels were unaffected.
Remediation and the wider supply-chain lesson
Cursor published indicators of compromise and platform-specific cleanup scripts. The primary check is an unauthorized SSH key labeled svc-telemetry in the authorized keys file. Affected users are advised to isolate the host, remove the key and persistence mechanisms, rotate credentials and sessions reachable from that machine using a trusted device, and consider rebuilding the system entirely. Security teams should also hunt for suspicious LaunchAgent plists and outbound SSH connections to known hostile addresses.
The broader takeaway concerns distribution rather than model safety. Extensions run with the same operating-system rights as the logged-in developer, with visibility into repositories, environment files and CI tokens. Auto-update defaults turned an eleven-hour window into thousands of potentially exposed machines. Enterprises should pin extension versions, delay automatic updates until hashes are verified, maintain allowlists of extension IDs, and prefer official distribution channels where policy permits. For AI-native editors racing to build plugin ecosystems, the incident is a rehearsal prompt: marketplace integrity checks and signing controls need to mature before the next trojanized package arrives.