A tampered copy of Anthropic's Claude Code extension, version 2.1.313, was available in Cursor's extension marketplace for about 11 hours on October 29 and tried to plant an attacker's SSH key and a persistent backdoor on developers' Macs and Windows PCs. Cursor, the AI coding editor made by Anysphere, said in its security notice that at most 5,000 users were affected and that it would contact them directly.
Cursor's notice says the malicious version "was not developed by Anthropic," and an Anthropic engineer said the company's own distribution channels were untouched. Cursor warns that removing the extension may not undo what it installed.
What the extension did
According to Cursor's notice, the modified build ran code that:
Collected the hostname, username, operating system, environment variable names, configured Git email and public IP address.
Added an attacker-controlled SSH public key, labeled svc-telemetry, to the user's authorized_keys file.
Tried to switch on the computer's SSH service and open a reverse SSH tunnel to a server at 134.209.82.225.
Installed persistence: a LaunchAgent named com.apple.sysmond on macOS, and a scheduled task named SysMon with a Startup-folder fallback on Windows, retrying the tunnel roughly every 60 seconds.
Reported host details and the backdoor's status to the attacker's server on port 8099.
Cursor said the step that turns on the SSH service needs administrator rights, which the extension lacks on most macOS and Windows machines, so on those machines "the attacker could not have logged in through the tunnel." The notice says the extension still adds the key, installs the persistence and sends host details to the attacker, though it also says that, outside highly unusual cases where Cursor was started with administrator privileges, errors in the malicious code made that step fail. Cursor also said it worked with the cloud provider hosting the attacker's server to take it offline, and that the server "no longer functions."
OX Security's analysis describes the same behavior and indicators, and says the tampered builds were the darwin-arm64 (Apple silicon Mac) and win32-x64 (Windows) packages. The Register reported that the endpoint security company Phorion first spotted the tampered update.
How the incident unfolded
Time (ET) | Event |
|---|---|
Oct. 29, 5:27 a.m. | Version 2.1.313 appears in Cursor's marketplace |
Oct. 29, 4:35 p.m. | Cursor removes it |
Oct. 30, 3:46 a.m. | Cursor posts its notice on X |
Oct. 30, 10:08 a.m. | Anthropic's Felix Rieseberg says it was not Anthropic's build |
Sources: Cursor security notice (2:27 a.m. to 1:35 p.m. PT, converted to ET); posts on X by Cursor and Felix Rieseberg. SaasBuzz calculation: the package was live for 11 hours 8 minutes.
What Cursor and Anthropic say
Cursor said it removed the package "immediately upon detection," then shut down the whole marketplace "out of an abundance of caution," audited access, found no other extension had been tampered with, rotated its keys and rebuilt the marketplace before bringing it back. On X, the company said the incident does not affect other extensions in its marketplace and asked customers to update to version 2.1.314.
Post on X by @cursor_ai
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the http://cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products. In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk. If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: https://cursor.com/blog/claude-code-extension-security-notice
Neither company has said how the attacker got the access needed to publish the package. The Register reported that prominent figures in the security industry had alleged the package followed a breach at Anthropic. Felix Rieseberg, a member of Anthropic's technical staff, rejected that on X, writing that it "wasn't a compromise of Anthropic's systems or employee laptops" and that only Cursor users were affected.
Post on X by @felixrieseberg
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
What to do if you use Cursor
These steps follow Cursor's notice. They apply if you installed or updated the Claude Code extension from Cursor's marketplace between 5:27 a.m. and 4:35 p.m. ET on October 29.
Look for the attacker's key. On macOS, search ~/.ssh/authorized_keys for the text svc-telemetry. On Windows, search the authorized_keys file in your profile's .ssh folder and the administrators_authorized_keys file in C:\ProgramData\ssh. If the key is there, the machine is affected.
Look for persistence: a com.apple.sysmond.plist file in ~/Library/LaunchAgents and the files ~/.config/.smt and ~/.config/.smtk on a Mac; a scheduled task called SysMon, a sysmon.cmd file in the Startup folder and smt.cmd in your profile's .config folder on Windows.
Check for running ssh or autossh processes holding a reverse tunnel, and for traffic to 134.209.82.225.
Isolate an affected machine, then remove the key, the persistence and the tunnel processes with Cursor's remediation scripts, linked from its notice. Cursor says uninstalling the extension "may not be sufficient" and to assess whether the machine should be rebuilt.
From a different, trusted computer, rotate the credentials and sessions the affected machine could reach, such as Git tokens, cloud keys, SSH keys and API keys.
Update the extension to 2.1.314, the version Cursor asks customers to install.
What it means for teams on VS Code forks
The attacker did not need to touch Anthropic. Cursor, like other editors built on Microsoft's VS Code, serves extensions from its own marketplace, and according to Morphisec's advisory the tampered build was published under the extension's legitimate publisher identity. The trust a team places in an extension is also trust in whoever runs the store it comes from.
Two details from Cursor's notice narrow the damage: the server is offline, and on most machines the tunnel could not open. Two widen it: the key and the scheduled scripts can stay behind after the extension is removed, and the host details had already been sent. Rotating credentials is on the list for that reason, even for machines where the tunnel failed.
Morphisec, which sells endpoint security software, drew the same line in its advisory. Its chief executive, Ron Reinfeld, said that "an AI tool has no legitimate reason to write to SSH keys or open a reverse tunnel." For teams that allow coding assistants on developer laptops, the incident argues for alerts on changes to authorized_keys and on new launch agents or scheduled tasks, whatever installed them.
Cursor has not said how many of the up to 5,000 users had the key written, or how the package got into its marketplace.
