Fake Claude Code Extension Planted SSH Backdoors on Developer Machines via Cursor Marketplace
A tampered copy of Anthropic's coding assistant sat in the Cursor extension store for roughly eleven hours on October 29, silently trying to unlock remote access to every machine that loaded it.
Key points
- On October 29, 2026, two malicious versions of the Claude Code extension (versions 2.1.312 and 2.1.313) were served through Cursor's extension marketplace for approximately eleven hours, from 2:27 AM to 1:35 PM Pacific time.
- The tampered packages never appeared on the official Visual Studio Marketplace or the official npm package registry, so only Cursor users were exposed.
- The malware fired the moment the extension loaded. No clicks, no interaction required.
- A criminal used access to Cursor's marketplace directly to publish the modified extension; Anthropic confirmed its own systems were untouched.
- Uninstalling the extension alone may not be enough: the malware planted files outside the extension folder, and any SSH key it added stays on a machine until someone removes it manually.
A fake version of Claude Code, Anthropic's AI coding assistant, spent nearly half a day hiding inside the Cursor extension marketplace before anyone caught it. Cursor is a popular code editor built on top of Visual Studio Code. An extension is a small add-on program that editors like this use to add new features, and developers typically install them with a single click, trusting that the marketplace has checked them.
Somebody hadn't.
How did the attackers get in?
Anthropic's systems were not broken into. According to Microsoft's analysis published October 30, a criminal used access to Cursor's own marketplace to publish two modified copies of the extension without touching Anthropic's code or infrastructure. Felix Rieseberg, a member of Anthropic's technical staff, confirmed on X that the official packages on npm and on Microsoft's Visual Studio Marketplace were clean throughout.
That distinction matters. The attack was a supply-chain hijack at the distribution point, not at the software maker. Think of it like a criminal swapping a genuine product on a store shelf rather than tampering with the factory.
What did the malware actually do?
The injected code ran the instant a developer opened Cursor with the extension installed. It attempted to add an attacker-controlled SSH key to the machine (SSH, or Secure Shell, is a standard protocol for logging into a computer remotely), switch on the local SSH service so remote connections were possible, open a reverse tunnel back to a server the attacker controlled, and plant startup scripts so all of this survived a reboot.
Microsoft Threat Intelligence, whose work on AI-assisted attacks we reported the day before this incident, also found that the malware quietly collected machine names, usernames, working directories, and Git email addresses. It searched for environment-variable names containing words like KEY, TOKEN, SECRET, PASS, AWS, or GCP, keeping up to forty matches. It harvested those names, not their values, though the list alone tells an attacker exactly which secrets to hunt for once they have a live connection.
Two bugs limited the damage. Checking whether remote login was disabled on macOS required administrator rights the extension didn't have, so that step silently failed. A formatting error in the Windows SSH setup command could also prevent it from running. Neither bug made the extension safe: the SSH key and the persistence scripts could still land on a machine regardless.
| Event | Detail |
|---|---|
| Extension live in Cursor marketplace | 2:27 AM PDT, October 29, 2026 |
| Extension removed by Cursor | ~1:35 PM PDT, October 29, 2026 |
| Affected versions | 2.1.312 and 2.1.313 |
| Platforms targeted | Windows and macOS |
| Official VS Marketplace / npm affected | No |
| Anthropic systems broken into | No |
Should developers who installed this extension be worried?
Yes, and deleting the extension is only the first step. Cursor warned that the malware placed scripts outside the extension's installation folder, so the normal uninstall routine won't find them. Any SSH key the malware planted stays active until someone removes it manually from the machine's list of trusted keys.
Steve Povolny, vice president of AI strategy and security research at Exabeam, told CSO Online: "Removing the extension only sends the visitor away while the spare key stays on the hook." He recommended checking authorised SSH keys on affected machines, rotating potentially exposed credentials, and reviewing login logs for connections made with unrecognised keys. Security firm Phorion, which analysed the extension, added that checking the SSH key by its fingerprint is more reliable than searching for the comment svc-telemetry alone. Developers routinely hold access to source repositories and cloud environments, which makes a compromised laptop a door into far larger things.
Cursor says it shut down its marketplace temporarily, audited access, rotated its own credentials, and rebuilt the service before bringing it back online. That's the right call, and it should be the baseline expectation for any extension store at this scale.
This is the pattern LiteLLM's pipeline hijack in October already showed: the update path is the attack surface now. Most enterprises still treat extension marketplaces like smartphone app stores, assuming the checking is done upstream. When it isn't, the blast radius lands directly on developer machines and, through them, on everything those developers can reach.
