- A malicious Claude Code extension reached numerous developer machines via Cursor’s marketplace for 11 hours on October 29, 2026.
- The attacker published the tampered extension under Anthropic’s legitimate identifier, anthropic.claude-code, after gaining unauthorised publish access whose method remains publicly unexplained.
- The payload installed a persistent SSH backdoor and collected host reconnaissance data, including environment variable names; affected users were advised to rotate all credentials that may have been exposed on compromised machines.
A trojanized version of Anthropic’s Claude Code extension sat in Cursor’s extension marketplace on October 29, 2026, long enough to reach numerous developer machines before anyone pulled it. The payload installed a persistent SSH backdoor, harvested credentials and environment variables, and set up reboot-surviving persistence on both macOS and Windows.
How the Attack Got In
The attacker gained unauthorised access to Cursor’s VS Code Extension Marketplace and published a tampered build under Anthropic’s legitimate extension identifier, `anthropic.claude-code`, as versions 2.1.312 and 2.1.313. Developers updating through Cursor’s marketplace had no obvious signal the package was fake. Anthropic confirmed its own systems, employee laptops and official distribution channels, including Open VSX and the Microsoft VS Code Marketplace, were not touched. The compromise was isolated to Cursor’s marketplace. How the attacker obtained the credentials needed to publish under Anthropic’s publisher identity remains publicly unexplained.
What the Backdoor Actually Did
The malicious build ran a 66-line loader on activation. No user interaction required. It attempted to add an attacker-controlled SSH key, labelled “svc-telemetry,” to ~/.ssh/authorized_keys, enable the local SSH service, and open a reverse SSH tunnel to a remote server. Enabling SSH requires admin rights the extension lacked on most macOS and Windows hosts, so on those machines the step failed and the attacker could not actually log in through the tunnel — though the unauthorised key, the persistence mechanisms and the reconnaissance beacon still ran regardless.
Beyond the backdoor, the malware collected reconnaissance data over an unencrypted HTTP request: public IP addresses, hostnames, usernames, Git email configurations and the names of up to 40 environment variables. Developer workstations were the target, and developer workstations tend to hold access tokens, private source code and cloud platform credentials.
Remediation Steps
Uninstalling the extension was not enough. The payload dropped standalone persistence scripts that kept running after removal. Cursor advised affected users to isolate compromised hosts, strip the unauthorised SSH key and any persistence mechanisms, check for indicators of compromise, and rotate all credentials and sessions from a clean machine. The credential rotation piece is the one that stings, any secret accessible from an affected workstation during that 11-hour window should be treated as exposed.
Cursor’s Response
Cursor removed the malicious package, took the marketplace offline, audited other extensions, rotated its own access keys and rebuilt the marketplace before bringing it back. The company also worked with its cloud hosting provider to take down the attacker’s infrastructure, cutting off both the reverse SSH connections and the data exfiltration endpoint. What Cursor has not yet disclosed is how the attacker gained publish access under Anthropic’s identity in the first place, the gap that made the attack possible and the one most relevant to other marketplace operators.
Extension Marketplaces as Attack Surface
IDE extensions are highly privileged software. They run code, touch the filesystem and make network requests with the same permissions as the host process. That access is what makes tools like LangChain-connected extensions and AI coding agents useful, and what makes a compromised one dangerous. The risks of giving AI coding tools broad system access have been discussed in the context of CI/CD pipelines, but this incident puts the threat one layer earlier: in the marketplace itself, before a single line of agent-generated code runs.
Publishing under a trusted identity, even briefly, is a supply chain attack in the classic sense. The attacker did not need to compromise Anthropic. They needed to compromise Cursor’s publish pipeline, and the damage radius extended to every developer who had auto-updates enabled. Stricter code signing, publisher identity verification and automated anomaly detection on package uploads are the obvious fixes. None of them are new ideas; this incident is evidence they have not been implemented consistently enough in AI-tool marketplaces specifically.
