Tampered Claude Code Build Sat in Cursor's Marketplace for 11 Hours
Between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026, a maliciously modified Claude Code extension was available in Cursor's VS Code extension marketplace, a window of roughly 11 hours. The rogue build, version 2.1.313, superseded the legitimate 2.1.312 under the real Anthropic.claude-code identity. Because Cursor enables extension auto-update by default, users who installed or updated during that window could have pulled the malware silently. Cursor puts the exposed population at a maximum of about 5,000 users.
Cursor said the tampered extension was not developed by Anthropic. Anthropic echoed that its own systems and employee machines were not compromised, saying a malicious actor abused access to Cursor's marketplace to publish the doctored copy, which Anthropic neither built nor published. Versions distributed through Anthropic's official channels were unaffected, and only Cursor users were in scope. A clean version 2.1.314 has since been published to Open VSX and the Microsoft VS Code Marketplace.
The payload fired as soon as the editor activated the extension, with no AI conversation needed. It first collected hostname, username, operating system and architecture, home directory path, environment variable names, working directories, Git email addresses, and the public IP address. It then appended an attacker-controlled public key labeled "svc-telemetry" to the user's SSH authorized_keys file, tried to switch on the local SSH daemon, and attempted to open a reverse SSH tunnel. Persistence differed by platform: a com.apple.sysmond LaunchAgent on macOS, an @reboot crontab entry pointing at files under ~/.config on Linux, and a SysMon scheduled task on Windows.
According to Cursor, outside the unusual case where Cursor ran with administrator privileges, errors in the malware meant the SSH-enable and tunnel steps failed on most macOS and Windows hosts. That failure did not make victims safe: the unauthorized key, the persistence mechanisms, and the exfiltrated host data remained. Security researchers warn that merely uninstalling the extension is not enough, because the dropped standalone scripts keep running and must be removed separately.
Cursor removed the backdoored build as soon as it was detected, blocked further distribution, and temporarily shut down its whole VS Code marketplace to rotate keys, audit access controls, and confirm that no other extensions were tampered with. The marketplace has since reopened. The company also worked with the cloud provider hosting the server behind the reverse tunnel so infected devices could no longer reach it. Users who took 2.1.313 during the window are told to isolate affected hosts, delete the svc-telemetry key and persistence artifacts, rotate credentials and sessions, and update to 2.1.314. Cursor says it will contact impacted users directly.