On 29 October 2026 a tampered build of the Claude Code extension sat in Cursor’s extension marketplace for about eleven hours. It did not take credentials. It added an attacker-controlled SSH key to the developer’s machine, installed persistence, and reported home which credential variables that machine holds. Cursor says at most 5,000 users were affected. Researchers call the code sloppy, and parts of it failed. The intent is the part worth your afternoon: it went for standing access on a machine that already holds the keys to your repositories, your registries and your cloud.
TL;DR
- Per Cursor’s security notice, Anthropic.claude-code version 2.1.313 was available in its extension marketplace between about 2:27am and 1:35pm PT on 29 October. Cursor states the version was not developed by Anthropic.
- Cursor says at most 5,000 users were affected and that it is contacting them directly.
- Researchers at Phorion and OpenSourceMalware found a loader prepended to extension.js, with the legitimate code left unchanged. It runs when Node loads the file, before the activate callback, with no user interaction.
- The payload adds an SSH key commented svc-telemetry, installs a LaunchAgent on macOS or a scheduled task on Windows, and retries a reverse tunnel roughly every 60 seconds.
- Per Help Net Security, citing Phorion, it reported the names, not the values, of up to 40 key-like environment variables, alongside hostname, user, OS, Git email and public IP.
#What Cursor published
Cursor’s notice is short and specific. The package was Anthropic.claude-code at version 2.1.313 in the Cursor VS Code extension marketplace. The window was “between about 2:27am PT and 1:35pm PT today” on 29 October 2026. On origin, Cursor writes: “This malicious version of the extension was not developed by Anthropic.” On scope: “At most 5,000 users were affected, and we will reach out directly.”
The response was broad for an eleven hour window. Cursor removed the version, blocked further distribution, then shut down its marketplace entirely as a precaution. It audited access, says it confirmed no other extensions were tampered with, rotated keys, rebuilt the marketplace and brought it back online, and worked with the hosting provider to take the attacker’s server offline. It adds that it has “no evidence that other versions of the extension or the official distribution are affected.”
One detail is worth flagging rather than smoothing over. Early coverage named several distribution channels. BleepingComputer writes that Cursor’s marketplace was later confirmed as the only source, while Help Net Security describes the build as published on Open VSX. The accounts differ, and both agree Microsoft’s Visual Studio Marketplace did not carry it. How the package came to be published under Anthropic’s name has not been explained publicly.
#The access path, step by step
# per the Cursor security notice and the Phorion analysis marketplace # Anthropic.claude-code 2.1.313, about eleven hours on 29 October → extension # a loader prepended to extension.js, the rest unchanged → editor load # Node runs it before the activate callback, no click needed → ssh key # attacker key added, LaunchAgent or scheduled task for persistence → host reach # names of up to 40 credential variables reported home
There is no exploit in that chain and no prompt injection. An extension is code you install on purpose, and the marketplace is the trust boundary. Help Net Security describes the injected code as an immediately invoked function at the start of extension.js, executing as soon as Node reads the file. The usual mental model, that an extension activates when you use it, does not apply.
#The payload went for access, not secrets
BleepingComputer notes that the script did not directly steal credentials. For an infostealer that would be a failure. Here it reads like a choice. Taking a token gets you that token until it is rotated. Planting an SSH key with persistence gets you the machine, and a developer machine is a bundle of non-human identities: Git and registry tokens, cloud CLI sessions, SSH keys to build hosts, model provider keys, and the files coding agents keep their own credentials in.
That inventory is what the reconnaissance step enumerates. Per Cursor, the beacon carries hostname, username, operating system, architecture and public IP. Per Help Net Security, it also carries the Git email and the names of up to 40 key-like environment variables. Names without values are not a leak in the usual sense. They are a shopping list: which cloud, which provider, which CI system, and which of the 5,000 machines is worth coming back to.
| What the payload did | Why it matters for machine identity |
|---|---|
| Added an SSH key labelled svc-telemetry | A credential the attacker controls, living where the developer’s own trust lives |
| Installed a LaunchAgent or scheduled task | Survives the editor closing, so access is not tied to the session |
| Retried a reverse tunnel about every 60 seconds | Waits for the condition it needs rather than failing once |
| Reported names of key-like environment variables | Tells the attacker which identities the host can reach, before touching them |
#Why “it probably failed” is not a clean bill of health
Phorion found coding errors that likely prevented remote access on many systems. Per BleepingComputer, the macOS systemsetup -getremotelogin check ran without elevated privileges, so SSH was never enabled where Remote Login was off, and the Windows setup was routed through /bin/sh, which is not present on a standard install. It is tempting to file this under near miss.
Two things argue against that. Cursor states that without administrator rights the extension still adds the key, installs persistence and sends host details, so what failed was the tunnel, not the foothold. And Phorion’s own caveat, as Help Net Security reports it, is that the macOS limitation is not a real defence: the backdoor works if Remote Login is already on, or is switched on later for an unrelated reason. A dormant key in an authorised keys file is a condition waiting to be met.
Cursor also says plainly that uninstalling the extension may not be enough, because the payload drops standalone persistence scripts. The extension was the delivery. The key and the scheduled job are what stays.
#What to check this week
- Search authorised keys for svc-telemetry on every machine that could have installed the extension during the window. Cursor publishes the key fingerprint and check scripts for macOS and Windows in its notice.
- Hunt the persistence, not the extension. On macOS, ~/.config/.smt, ~/.config/.smtk and ~/Library/LaunchAgents/com.apple.sysmond.plist. On Windows, a scheduled task named SysMon and sysmon.cmd in the Startup folder.
- Check SSH logs for localhost logins using that key, which Help Net Security names as the clearest sign the tunnel came up.
- Check egress for the attacker address 134.209.82.225 and for beacons to port 8099. Developer laptops are usually the least monitored egress in the estate.
- Rotate what the host could reach, from a trusted system: Git and registry tokens, cloud CLI sessions, SSH keys, coding agent and model provider keys, and any CI secret that was present locally. Cursor’s guidance is the same, and it is the step most often skipped when the backdoor looks broken.
- Write down what an editor extension reaches. Which repositories, which cloud accounts, which production systems are one laptop away. That inventory outlives this incident, and it is the only part of it you control.
On Elmoz
#FAQ
Which version was affected?
Cursor’s notice names Anthropic.claude-code version 2.1.313, available in its extension marketplace between about 2:27am and 1:35pm PT on 29 October 2026. Cursor says it has no evidence that other versions of the extension or the official distribution are affected, and that the malicious version was not developed by Anthropic.
Did the backdoor actually work?
Not reliably. Phorion found coding errors that likely prevented remote access on many systems, including a macOS privilege check and a Windows setup routed through a shell that is not present. Cursor says that without administrator rights the extension still adds the SSH key, installs persistence and sends host details, so the reconnaissance succeeded even where the tunnel did not.
Does uninstalling the extension remove it?
Cursor says uninstalling may not be enough, because the payload drops standalone persistence scripts. Check for the SSH key labelled svc-telemetry, remove the persistence entries and the tunnel processes using Cursor’s remediation scripts, and consider rebuilding the machine.
What data left the machine?
Per Cursor, hostname, username, operating system, architecture and public IP, plus backdoor status, sent to an attacker server on port 8099. Help Net Security adds, citing Phorion, the home and working directories, the Git email, and the names, not the values, of up to 40 key-like environment variables such as cloud and API credentials.
An editor extension runs with the developer’s identity, and a developer’s identity is a bundle of non-human identities. Elmoz maps that reach, from the laptop and the coding agent on it to the repositories, registries and cloud accounts behind, so the blast radius of one install is a number rather than a guess.