# A tampered Claude Code extension on Cursor’s marketplace planted a backdoor on up to 5,000 machines

URL: https://ai-pulse.aglaganova.com/blog/a-tampered-claude-code-extension-on-cursors-marketplace-planted-a-backdoor-on-up-to-5-000-machines
Published: 2026-10-31
Author: Roman Aglaganov, Full-stack developer
Category: Tools
Region: Global
Tags: coding, safety

> For about 11 hours on 29 October, Cursor’s extension marketplace served a fake update, version 2.1.313, under Anthropic’s name. It added an attacker’s SSH key and tried to open a tunnel. Copies installed from other marketplaces were not affected.

![Illustration: a black puzzle-piece outline slotting into a grey grid of matching pieces, with a thin red line running from it out of the frame](https://ai-pulse.aglaganova.com/api/media/file/claude-code-extension-1.png)

Developers who use the Cursor code editor and installed or auto-updated Anthropic’s Claude Code extension on 29 October should check their machines. A modified version of the extension, numbered 2.1.313, was published on Cursor’s extension marketplace under the extension’s real identity, anthropic.claude-code, and contained a backdoor.

## What happened

Cursor says the malicious version was available between about 2:27 a.m. and 1:35 p.m. Pacific time on 29 October and affected at most 5,000 users. It temporarily shut its marketplace to remove the package, rotated its keys, rebuilt the marketplace and worked with a cloud provider to take the attacker’s server offline. It says no other extensions were tampered with and that it is contacting affected users directly.

The tampered update reached only Cursor’s marketplace. Microsoft says it was never published on the Visual Studio Marketplace or in the npm package, and the security firm Socket found no evidence that it reached Open VSX. Anthropic says its own systems were not compromised. “The versions on our official channels including VS Code and OpenVSX are not affected and this only impacts Cursor users,” Anthropic security engineer David Dworken wrote. The latest genuine version is 2.1.314. How the attacker managed to publish under Anthropic’s name on Cursor’s marketplace has not been explained.

## What the backdoor did

Researchers found a 66-line loader inserted before the real extension code. When the extension started, it added an attacker-controlled key, labelled “svc-telemetry”, to the user’s ~/.ssh/authorized_keys file, tried to turn on the computer’s SSH service and open a reverse tunnel to the attacker, set itself to run at startup, and sent details about the machine to the attacker. Cursor notes that turning on SSH needs administrator rights, which the extension did not have on most Macs and Windows PCs, so on those the attacker probably could not log in. The other steps still ran.

## What to do

If you use Cursor, check whether version 2.1.313 was ever installed. If it was, Microsoft advises that removing or updating the extension is not enough, because it wrote files outside its own folder. Isolate the machine, delete the “svc-telemetry” key from ~/.ssh/authorized_keys, remove any new scheduled task, crontab entry or LaunchAgent, and rotate passwords, keys and login sessions that the machine could reach.

Disclosure: AI Pulse is written with AI tools, including Claude, which is made by Anthropic.

## Sources

- [The Hacker News: Official Claude Code extension on Cursor Marketplace trojanized with persistent SSH backdoor](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html)