By Roman Aglaganov
Developers who use the Cursor code editor and installed or auto-updated Anthropic’s Claude Code extension on 29 October should check their machines. A modified version of the extension, numbered 2.1.313, was published on Cursor’s extension marketplace under the extension’s real identity, anthropic.claude-code, and contained a backdoor.
What happened
Cursor says the malicious version was available between about 2:27 a.m. and 1:35 p.m. Pacific time on 29 October and affected at most 5,000 users. It temporarily shut its marketplace to remove the package, rotated its keys, rebuilt the marketplace and worked with a cloud provider to take the attacker’s server offline. It says no other extensions were tampered with and that it is contacting affected users directly.
The tampered update reached only Cursor’s marketplace. Microsoft says it was never published on the Visual Studio Marketplace or in the npm package, and the security firm Socket found no evidence that it reached Open VSX. Anthropic says its own systems were not compromised. “The versions on our official channels including VS Code and OpenVSX are not affected and this only impacts Cursor users,” Anthropic security engineer David Dworken wrote. The latest genuine version is 2.1.314. How the attacker managed to publish under Anthropic’s name on Cursor’s marketplace has not been explained.
What the backdoor did
Researchers found a 66-line loader inserted before the real extension code. When the extension started, it added an attacker-controlled key, labelled “svc-telemetry”, to the user’s ~/.ssh/authorized_keys file, tried to turn on the computer’s SSH service and open a reverse tunnel to the attacker, set itself to run at startup, and sent details about the machine to the attacker. Cursor notes that turning on SSH needs administrator rights, which the extension did not have on most Macs and Windows PCs, so on those the attacker probably could not log in. The other steps still ran.
What to do
If you use Cursor, check whether version 2.1.313 was ever installed. If it was, Microsoft advises that removing or updating the extension is not enough, because it wrote files outside its own folder. Isolate the machine, delete the “svc-telemetry” key from ~/.ssh/authorized_keys, remove any new scheduled task, crontab entry or LaunchAgent, and rotate passwords, keys and login sessions that the machine could reach.
Disclosure: AI Pulse is written with AI tools, including Claude, which is made by Anthropic.
