Claude Code extension on Cursor backdoored: what to check

1. What happened

In its official security notice, Cursor said malicious, modified builds of Anthropic.claude-code, versions 2.1.312 and 2.1.313 for Windows and macOS, were served from its extension marketplace. They were available from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29 (roughly 6:27 p.m. on the 29th to 5:35 a.m. on the 30th in Japan), and Cursor says Anthropic did not build them. The extension sends details such as hostname, username, OS and public IP to the attacker, tries to add the attacker's SSH key to authorized_keys, and tries to open a reverse SSH tunnel. On Windows and macOS it also set up persistence so the tunnel would survive restarts (Cursor notice).

Cursor says it removed the malicious versions as soon as they were detected and blocked further distribution, shut the whole marketplace as a precaution, rotated keys, audited access, and confirmed that no other extensions were tampered with. It also says it worked with the hosting provider to take the attacker's server offline (Cursor notice). On the scale, Ars Technica reports Cursor's statement that at most 5,000 users were affected. According to the same article, independent researcher Kevin Beaumont said Anthropic pushed a clean version 2.1.314 several hours later. Neither Cursor nor Anthropic has explained how the attackers gained control of the official account, and Anthropic had not warned customers (Ars Technica).

2. How serious it is: it partly failed, but do not relax

Cursor says that enabling the SSH service requires admin rights, so on most macOS and Windows machines, helped by bugs in the malicious code, the attacker could not log in through the tunnel. The attacker's key was still added, persistence was still installed and host details were still sent, so Cursor tells affected users to follow its check-and-remove steps, and notes that uninstalling the extension alone may not be enough (Cursor notice). Phorion likewise finds that a coding error can break the access path on macOS, but because persistence and reconnaissance still work, it still rates the malware a significant threat (Phorion analysis).

Sources differ on which versions are affected. Ars Technica named only 2.1.313, while Cursor's notice and Phorion's October 31 update cover both 2.1.312 and 2.1.313. This article follows Cursor's notice.

Our view We think the core of this incident is that extensions for AI coding tools have become trusted components that sit permanently on developers' machines. An update published under the official account looks identical to a genuine one from the user's side, and Phorion's CTO told Ars Technica that extensions auto-update in Cursor by default (Ars Technica). A developer's machine holds source code, connection details for customer systems and cloud keys. If it is breached, the damage does not stop at that PC; it can reach clients' systems. Companies whose contractors use AI tools should ask now which tools and extensions are allowed, or they will have no answer when a client asks.

3. What small businesses should check now

List who, in-house and at contractors, uses Cursor and who installed the Claude Code extension (affected platforms: macOS and Windows)
For anyone who installed or updated on October 29, 2026, check whether the extension version was 2.1.312 or 2.1.313
Use the command in Cursor's notice to check ~/.ssh/authorized_keys for a key labelled svc-telemetry (if found, treat the machine as affected)
If the key is found, disconnect the machine, run the removal script Cursor provides, and change passwords, API keys and cloud keys reachable from that machine, working from a separate trusted device
Turn off extension auto-update, or set a list of approved extensions and name someone to review updates

Our outlook

Over the next six months to two years, we expect AI coding tools and their extensions and plug-ins to become a routine part of small-company development and operations. For attackers, a component that sits permanently on developers' machines is an efficient way in: take over one official account and you reach many users. Clients are also likely to start asking how suppliers manage their development environments, AI included, when they choose a partner. Companies that have documented which tools and extensions they use, their auto-update policy and where keys are kept can answer such questions the same day. Those that have not risk being dropped at the inquiry stage. Now is the time to lay the groundwork for protecting the way you use AI.

Questions this article answers

What is the tampered Claude Code extension on Cursor, and are we affected?

On October 29, 2026, tampered builds of Anthropic.claude-code, versions 2.1.312 and 2.1.313 for Windows and macOS, were served on Cursor's extension marketplace for about 11 hours. Anyone who installed or updated the extension in Cursor in that window may be affected. Use the command in Cursor's notice to check your SSH keys for one labelled svc-telemetry.

If we are affected, is uninstalling the extension enough?

Not necessarily. Cursor says the malicious extension drops standalone persistence scripts, so uninstalling it may leave them running. Disconnect the affected machine, run the removal script Cursor provides, and change the credentials that machine could access from a separate trusted device.

Sources

Related Q&A

Related services

If you want to try this in your own business

To see how the topics in this article would apply to your own operations, and what it would cost, send us a message through the contact form.