Short answer
Cursor says a tampered build of the anthropic.claude-code extension was available on its marketplace from about 2:27 am to 1:35 pm PT on 29 October 2026. It added an attacker's SSH key, tried to open a reverse tunnel and sent host details to an attacker server. Anthropic says its own systems were not compromised.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Cursor |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Confirmed by the organization |
| Sector | Developer tools and extension marketplace |
| Country | United States |
| Detected | 2026-10-29 |
| Disclosed | 2026-10-29 |
| People or records affected | Users of the Cursor marketplace who installed or updated to versions 2.1.312 or 2.1.313 on macOS or Windows; The Hacker News reports Cursor's estimate of at most 5,000 users |
What data was exposed
- Host details: hostname, username, operating system, architecture, home and working directories, Git email and public IP
- Names, not values, of environment variables containing words such as KEY, TOKEN or SECRET
- A planted SSH key and persistence mechanisms that could give the attacker remote access
What happened
Cursor, the AI code editor, published a security notice about a malicious version of the Claude Code extension on its extension marketplace. It says versions 2.1.312 and 2.1.313 of anthropic.claude-code were available between about 2:27 am and 1:35 pm Pacific on 29 October 2026, and it updated the indicators of compromise on 30 October.
Cursor says Anthropic did not develop those versions. The Hacker News reports that Anthropic said a malicious actor used access to Cursor’s marketplace and that its own systems were not compromised. How the attacker published under that name has not been explained publicly.
What the code did
Microsoft’s analysis says the tampered extension carried injected JavaScript that ran when the module loaded. It collected host details and the names of environment variables with words like KEY, TOKEN or SECRET, but not their values. It tried to append an attacker’s SSH key, labeled svc-telemetry, to the user’s authorized_keys file and to enable the local SSH service. It then tried to open a reverse SSH tunnel to attacker infrastructure and set up persistence disguised as monitoring software.
Cursor says the tunnel step usually needed administrator rights and would fail on most machines, but the key and persistence files could still be written. The Hacker News reports no follow-on payloads had been observed.
Response
Cursor says the attacker’s server is offline and the malicious version was removed. The Hacker News reports Cursor temporarily shut the marketplace, rotated keys and rebuilt it, and said it would contact affected users directly. Microsoft reported no evidence of distribution through the Visual Studio Marketplace or npm.
What to do
Check your editor’s extension history for the two versions. Cursor’s notice gives commands to look for the svc-telemetry key and remediation scripts for macOS and Windows. It warns that removing the extension alone may not stop persistence scripts. Microsoft adds that you should preserve evidence before cleanup and rotate credentials only from a trusted system.
Developer tooling is a growing target for credential theft. See our data breach checklist and our guide to phishing messages, since fake cleanup instructions are a common follow-up. A related case is the LiteLLM package compromise.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'remediation' tools or scripts sent by email or chat that claim to clean the extension. Use only the scripts in Cursor's own notice.
- Phishing that impersonates Cursor, Anthropic or a security vendor and asks for credentials.
- Follow-on attacks on code repositories and cloud accounts if credentials on an affected machine were taken.
What to do if you are affected
- 01Check whether Cursor installed or updated anthropic.claude-code to 2.1.312 or 2.1.313 on 29 October 2026.
- 02Search your SSH authorized_keys file for a key labeled svc-telemetry, as described in Cursor's notice.
- 03If affected, isolate the machine and run Cursor's remediation script for your platform. Uninstalling the extension alone may not be enough.
- 04From a trusted machine, rotate credentials and sessions that the affected host could reach.
- 05Restrict extensions to approved publishers and consider a delay before auto-installing new versions.
Frequently asked questions
Was the real Claude Code extension compromised?
Cursor says Anthropic did not develop the affected versions and that it has no evidence other versions or the official distribution were affected. The Hacker News reports Anthropic said its own systems were not compromised and that official channels such as VS Code and Open VSX were not affected.
Which versions are affected?
Cursor lists anthropic.claude-code 2.1.312 and 2.1.313 for macOS and Windows. Microsoft found no evidence the build was distributed through the Visual Studio Marketplace or npm.
How many people were affected?
Cursor's notice does not give a number. The Hacker News reports Cursor said at most 5,000 users were affected.
How do I know if the backdoor was installed?
Look for an SSH key labeled svc-telemetry in your authorized_keys file and for leftover startup items. Cursor's notice has the exact commands and remediation scripts.
Sources
- Security notice: malicious Anthropic.claude-code extension, Cursor, 2026-10-30
- Inside the malicious Claude Code-branded Cursor extension with a persistent SSH backdoor, Microsoft Security Blog, 2026-10-30
- Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor, The Hacker News, 2026-10-30
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.