Announced 29 Oct 2026 · Sources checked
What happened
On October 29 2026, Cursor identified a security incident involving a specific extension in its VS Code Extension Marketplace: Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS. These versions were maliciously modified — not developed by Anthropic — and were available for download between approximately 2:27am and 1:35pm PT, a window of about 11 hours.
Cursor estimates up to 5,000 users may have been affected. The malicious version was removed from the marketplace upon detection, and Cursor shut down the entire marketplace as a precaution, audited access to confirm no other extensions were tampered with, rotated its own keys, brought the marketplace back online after rebuilding it, and worked with the attacker's hosting provider to take the command-and-control server offline.
The backdoor
The malicious extension collected host and user information: hostname, username, operating system, architecture, home directory path, environment variable names, working directories, Git email and public IP. It then attempted to add an attacker-controlled SSH key (labeled 'svc-telemetry') to the user's authorized_keys file, enable the local SSH service, and open a reverse SSH tunnel to a server at 134.209.82.225:8099.
The SSH enablement step requires administrator rights, and due to errors in the malicious code, it fails on most macOS and Windows hosts — meaning the attacker could not have logged in through the tunnel on those systems. However, the SSH key was still added, the persistence mechanisms were installed, and host details were exfiltrated to the attacker's server, which Cursor confirmed is no longer functional after working with the cloud provider.
Persistence
The extension drops standalone persistence scripts that continue running even after the extension itself is uninstalled. On macOS, a LaunchAgent is created; on Windows, a scheduled task attempts to run as SYSTEM with a Startup-script fallback. Background scripts retry the tunnel roughly every 60 seconds, though the attacker server is now offline.
Cursor provides remediation scripts that remove the malicious extension, the persistence mechanisms, running tunnel processes and the attacker's SSH key, exiting with non-zero status if anything remains. Affected users are also advised to rotate credentials and sessions accessible from the host.
Supply chain implications
The incident is a software supply-chain attack against a widely used AI developer tool, delivered through the official marketplace. While Cursor acted quickly — removing the extension, shutting down and rebuilding the marketplace — the 11-hour exposure window and 5,000 potential victims show how fast trust can be exploited in a platform ecosystem that auto-updates extensions.
For developers, the lesson is that marketplace extensions for AI tools — Claude Code, Copilot, Codex — are now attack surfaces. The malicious extension did not modify the underlying Claude Code AI but used the legitimate extension name and distribution channel to deliver its payload, making detection harder for users who trusted the official Anthropic publisher identity.
Caveats
Cursor estimates up to 5,000 users 'may have been' affected but has not confirmed a precise count; the actual number of users who installed the malicious versions during the window is not disclosed. The SSH backdoor's failure on most hosts due to coding errors limited the practical impact.
The attacker server was taken offline by Cursor's action, preventing ongoing compromise even for hosts where the backdoor was successfully installed. The post-incident analysis by Cursor, Ox Security and Sophos provides consistent findings.
Industry response
The incident drew immediate response from multiple security vendors. Ox Security published an independent analysis confirming the payload behavior and IOCs. Sophos also analyzed the extension and distributed detection guidance to its customers. The consistent finding is that this was a straightforward supply-chain attack using the social trust of the Anthropic brand and the official distribution channel — not a sophisticated zero-day exploit.
Cursor's decision to take down the entire marketplace, audit all extensions, rotate internal keys and rebuild the platform before bringing it back online is the kind of response that security teams look for as a model. For affected users, the practical advice is straightforward: run the Cursor-provided remediation script, check for the 'svc-telemetry' SSH key, and rotate any credentials accessible from the host. The attacker's server is offline, so no new reverse connections can be established, but already-deployed persistence could remain dormant.
Broader lessons
The attack exploits a structural vulnerability in the AI development toolchain: developers install extensions automatically and trust that marketplace distribution chains are secure. As AI coding tools like Claude Code, Copilot and Codex become more widely used, their distribution platforms will attract more supply-chain targeting — both because the tools have access to sensitive codebases and because the user base is developer-attentive enough that credential theft is high-value.
The response timeline — 11 hours from first availability to removal — is fast by industry standards but the damage depends on update cadence. Extension auto-update frequently runs on restart, and users who did not restart their editor during the exposure window would not have received the malicious version. This is a partial defense for users who keep their editors open across sessions, but not something to rely on.
Common questions
How many users were affected?
Up to 5,000 users potentially affected; exact count not confirmed.
What did the malicious extension do?
Collected host info, added SSH key, installed persistence scripts, attempted reverse tunnel. Due to coding errors, SSH enablement failed on most hosts.
Does uninstalling the extension clean it?
No — persistence scripts run independently. Use Cursor's remediation script to remove the backdoor completely.
Sources & further reading
How this story was made
Written by Kristian Kostov with AI assistance and checked against the linked sources. Company performance claims are attributed to the company. Analysis reflects AiLookout’s interpretation; we have not independently tested the products discussed. The cover is an AI-generated editorial illustration, not a photograph or evidence of an actual event.
Our editorial standards
