Cursor says tampered Claude Code extension hit up to 5,000 users

Felix Laurent 30 Oct 2026 5 min read

AI agents

Cursor says a maliciously modified version of Anthropic's Claude Code extension was available on its extension marketplace for about 11 hours on Oct 29. Cursor puts the impact at no more than 5,000 users. It says Anthropic did not develop the malicious version.

What Cursor announced

In a security notice dated Oct 29, Cursor said version 2.1.313 of the Claude Code extension for VS Code was served from the Cursor VS Code extension marketplace. It names the window as about 2:27am to 1:35pm PT, or 09:27 to 20:35 UTC. Cursor says it will contact affected users directly.

Cursor says it removed the version and shut down the whole marketplace as a precaution. It audited access, rotated its keys, rebuilt the marketplace and brought it back online. It also worked with the hosting provider to take the attacker's server offline, and says that server no longer works.

Cursor's post on X followed early on Oct 30 UTC, which was still the evening of Oct 29 in US time zones. Cursor says it has no evidence that other versions or the official distribution are affected. All of this is Cursor's own account, and no independent party has verified the user count. What the build did is better documented.

What the malicious build did

According to Cursor, the modified extension first collected host details: hostname, username, operating system, architecture, home path, working directories, Git email and public IP. Help Net Security, citing Mac security firm Phorion, says it also took the names of up to 40 environment variables that look like keys, tokens or cloud credentials. The values stayed on the machine.

The build then tried to add an attacker's key, labeled svc-telemetry, to the user's SSH authorized keys. It tried to switch on the local SSH service and open a reverse SSH tunnel to the IP address 134.209.82.225. It sent its reports over plain HTTP to port 8099 on the same server.

There is a limit, according to Cursor. Turning on SSH needs admin rights, which the extension does not have on most macOS and Windows machines. The step would fail unless Cursor was started as an administrator. Phorion's chief executive Calum Hall told Help Net Security that this is no defence on macOS, because a flawed check can still leave a working backdoor.

To survive, the build installs a LaunchAgent on macOS that poses as an Apple service, com.apple.sysmond. On Windows it creates a scheduled task called SysMon, with a Startup folder script as a fallback. Help Net Security adds that on Linux it sets a cron entry that runs at reboot. Cursor does not mention Linux. The persistence retries the tunnel about every 60 seconds, which is why removing the extension is not enough.

How to check your machine

Cursor asks all users to update to version 2.1.314, which Anthropic has published to Open VSX, npm and the Microsoft VS Code Marketplace. Cursor warns that uninstalling the extension may not be enough, because the payload drops standalone scripts that keep running.

Updating does not fix an infected machine either. Security researcher Kevin Beaumont says he confirmed that the replacement versions Anthropic published overnight, which install automatically, do not remove the backdoor or the recon activity. The reverse SSH connection keeps calling out, so every affected machine has to be cleaned by hand.

The quickest check is to search the SSH authorized keys file for svc-telemetry. On macOS, also look for ~/Library/LaunchAgents/com.apple.sysmond.plist and the hidden files ~/.config/.smt and ~/.config/.smtk. On Windows, look for a scheduled task named SysMon and a sysmon.cmd file in the Startup folder.

Cursor publishes cleanup scripts for macOS and Windows, with package hashes and the full list of indicators. It also suggests deciding whether the machine should be rebuilt. Cellcog goes further and recommends a rebuild, with credentials rotated from a clean machine. Where the build came from is less clear than what it did.

Which marketplace was hit

Cursor names only its own marketplace. Help Net Security first reported, citing Phorion, that the package was spotted on Open VSX, the open registry that VS Code forks such as Cursor and Windsurf rely on. Cellcog wrote that the build was published to both.

Help Net Security later added a dispute from Ax Sharma, head of research at Manifold Security, who says the Open VSX version was not compromised. The Hacker News corrected its own story the same way and now traces the incident to Cursor's marketplace. Cellcog's registry check on Oct 30 found no 2.1.313 on Open VSX, the VS Code Marketplace or npm. All three go straight from 2.1.312 to 2.1.314.

Sharma also pointed out why the usual advice failed here. Developers are told to check the publisher name, but this build came under the real one. Beaumont, who first called the incident an Anthropic hack, later wrote that the exposure looks limited to Cursor users. He says Cursor proxies Open VSX, so extensions published there also work in Cursor, and that how the build got in is still unclear. The two companies now point at each other.

What Anthropic says

Anthropic did not comment for most of Oct 30. Later that day Beaumont added a statement from the company to his blog: "A malicious actor used access to Cursor's marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this."

Beaumont disputes that framing. In Cursor, the extension still shows Anthropic as its publisher. He calls Cursor's line that Anthropic did not "develop" the build wordsmithing, since it was uploaded under Anthropic's verified account and Cursor updates extensions automatically. He also says Anthropic published fixed versions to Open VSX and the VS Code Marketplace overnight without telling anyone what had happened.

Neither company has published a full account. It is not the first time an extension store has been used this way.

Extension stores are a known target

In late 2025, Koi Security found GlassWorm, a self-spreading worm that hid its code in Open VSX extensions with invisible Unicode characters. The Eclipse Foundation called it contained, but the worm returned in November with three new extensions, BleepingComputer reported. A 2026 wave moved on to macOS developers.

GlassWorm used extensions under made-up names. The Claude Code build carried Anthropic's own name in a store developers already trust, which made it much harder to spot.

What is still unclear

Cursor does not say how the modified build got onto its marketplace. Cellcog reports that the researchers it cites do not know how it was published either. They say only that the Open VSX publishing account belongs to an Anthropic employee, who may or may not have been compromised. Anthropic says the breach was at Cursor's marketplace, and Cursor has not said how its marketplace was accessed.

So how did a backdoored build ship under Anthropic's name? Nobody has explained it. Cursor confirms the build, the window and the cap of 5,000 users, and the indicators are public. Anthropic says it had no part in building, publishing or hosting the build, which puts the breach on Cursor's side, but Cursor has not named the cause. What is clear is that the automatic update to 2.1.314 does not clean an infected machine. Anyone who ran Cursor on Oct 29 should check for a svc-telemetry key or a SysMon task by hand and treat either as a sign that the machine needs rebuilding.