Claude Code extension backdoor used Anthropic’s real ID

On Oct. 29, 2026, Cursor’s extension marketplace offered its users an update to Anthropic’s Claude Code extension that Anthropic didn’t write. Version 2.1.313 carried a loader that tried to plant a persistent SSH backdoor, and Cursor says up to 5,000 users were affected. The detail that should bother developers most is the label on the package: it used the real extension ID, anthropic.claude-code.

What shipped to Cursor users on October 29?

A tampered build of the Claude Code extension, version 2.1.313, was available on Cursor’s marketplace from about 2:27 a.m. to 1:35 p.m. Pacific, roughly 11 hours, according to The Hacker News and BleepingComputer. It arrived as a normal update, not a lookalike listing.

The attackers put a roughly 66-line loader in front of the legitimate code in the extension’s main JavaScript bundle and left everything else alone. The malicious code runs when the extension loads or its webview opens. You don’t have to touch Claude Code for it to fire.

Auto-update is what turns this from a nuisance into a problem. As OpenSourceMalware co-founder Jenn Gile put it to The Hacker News:

“It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware.”

Does it matter that Anthropic didn’t write the build?

No. Cursor’s position is that Anthropic had no hand in the tampered version, and that may be literally true. But a developer looking at the extension list saw the publisher and ID they already trusted, so the distinction means nothing at the moment of install.

The Register’s headline frames Anthropic as denying responsibility. Only the headline was available, so Anthropic’s actual statement isn’t captured here. BleepingComputer said it asked both Anthropic and Cursor for comment and hadn’t heard back when it published. The Hacker News argues Cursor’s line misses the point, and I agree with it. Who wrote the code is a question for the post-mortem. Who was allowed to publish under that ID is the question for everyone running the extension.

The marketplace trust model, and where it broke

When you accept updates from a publisher you’ve already installed, you’re trusting the marketplace to guarantee that an update under that ID came from that publisher. Here, something in that chain failed on Cursor’s marketplace, and nobody has said what.

Cursor says the malicious build went out only through its own marketplace, with no evidence it reached Open VSX or the Microsoft VS Code Marketplace. Cursor also says its investigation found no other affected extensions or versions. Those claims come from Cursor’s own investigation and haven’t been independently verified. Early reports wrongly named Open VSX, npm and Microsoft’s marketplace as affected, and both The Hacker News and BleepingComputer corrected that.

It’s tempting to read the single-marketplace spread as a Cursor-side failure. Nobody has said that, and Cursor hasn’t said whether its systems or any Anthropic publishing credentials were compromised. Cursor did shut down its whole marketplace temporarily to audit other extensions and rotate access keys. Anthropic has since published version 2.1.314 to Open VSX and the Microsoft marketplace.

What the malware did, and why it may have fizzled

The loader added an attacker-controlled SSH key labeled ‘svc-telemetry’ to ~/.ssh/authorized_keys, tried to enable SSH on Windows, Linux and macOS, and built a reverse tunnel back to the attacker at 134.209.82[.]225. It also sent host details to that address over unencrypted HTTP.

The data included public IP, hostname, local username, OS and CPU architecture, home and working directories, the global Git email, and the names (not values) of up to 40 environment variables containing strings like KEY, TOKEN, SECRET, PASS, AWS or GCP. Security researcher Paul McCarty told The Hacker News that names still matter:

“Their names can still reveal which cloud providers, CI systems, and credential types are configured.”

The malware doesn’t steal credentials directly, and no further payloads have been observed. Both outlets read that as a sign the attackers planned to work by hand through the tunnel.

On many Windows and macOS machines, the SSH step likely failed. The explanations differ. Cursor’s analysis, as relayed by The Hacker News, says enabling the local SSH service needs admin rights the extension lacks on most of those hosts. Phorion’s analysis says coding errors likely prevented access: on macOS a remote-login check runs without elevated privileges and errors out, and on Windows PowerShell is invoked through /bin/sh, which standard Windows doesn’t have. Even when SSH fails, the key is still added, persistence is still installed and host data still goes out.

Persistence details also vary by outlet. The Hacker News lists a scheduled task, a crontab entry and a macOS LaunchAgent. BleepingComputer lists a macOS LaunchAgent or a Windows scheduled task or Startup script, with the tunnel retried about every minute. BleepingComputer also reports that Cursor coordinated with the server’s host to knock the attacker’s infrastructure offline, which cut off the tunnels and uploads.

Why this matters if you work in an AI code editor

Your editor runs extensions with your user’s access, and your user’s home directory holds SSH keys, cloud credentials and Git config. A poisoned update to one trusted extension lands in exactly that place. The 5,000 figure is Cursor’s upper bound, so you can’t assume you were hit, but you can check in a few minutes.

Check which version of Claude Code you had on Oct. 29, and look in ~/.ssh/authorized_keys for the ‘svc-telemetry’ key. Check for the persistence entries and for traffic to 134.209.82[.]225. If you find any of it, the advice in both reports is to isolate the host, remove the key and persistence, rotate credentials and invalidate sessions. BleepingComputer also suggests rebuilding from safe backups. Cursor says it will contact affected users directly, but I wouldn’t wait for an email.

Rotating credentials is also a good moment to move your Git host and cloud accounts to hardware-backed sign-in, such as a YubiKey 5C NFC security key. I can’t tell you it would have stopped this attack, since nobody knows how the publishing was hijacked. It does shrink what a stolen key or token can do later.

I’d also stop treating auto-update on a high-privilege extension as a default. It’s a choice, and this incident shows what it costs when the marketplace gets it wrong. The same lesson shows up in the Binance hack, where one compromised laptop was the way in.

What nobody has explained yet

The central gap is how the attackers published a modified extension under Anthropic’s publisher ID on Cursor’s marketplace. It’s also unknown whether Cursor’s or Anthropic’s systems, credentials or publishing tokens were compromised, and whether Cursor’s marketplace has controls that stop one publisher’s ID from being used for unauthorized updates.

The scale is unclear too. Nobody has said how many of the up to 5,000 users installed and ran the extension, how many ended up with a working tunnel, or whether any machines were accessed or credentials misused. Who is behind the attack is unknown. Cursor hasn’t said when its marketplace came back, and Anthropic’s own account of events isn’t captured in what’s available.

The Hacker News mentions that a little over a week earlier, release binaries for five versions of OVHcloud’s official CLI were replaced with secret-stealing malware through a hijacked contributor GitHub account tied to the GlassWorm operation. No outlet says the two incidents are connected. It’s context for how often developer tooling is being targeted, and nothing more.

Frequently asked questions

Was the Claude Code extension on the VS Code Marketplace or Open VSX affected?

Cursor says the malicious version 2.1.313 went out only through its own marketplace, with no evidence it reached Open VSX or Microsoft's VS Code Marketplace. That comes from Cursor's own investigation and hasn't been independently verified.

How do I know if I installed the malicious Claude Code extension?

Check whether you ran version 2.1.313 on Oct. 29, 2026, and look in ~/.ssh/authorized_keys for a key labeled 'svc-telemetry'. Also check for new scheduled tasks, crontab entries or LaunchAgents and for traffic to 134.209.82[.]225.

Did the SSH backdoor actually work?

Probably not on many Windows and macOS machines. Cursor's analysis points to missing admin rights, while Phorion says coding errors likely blocked it. Either way the key, persistence and host-data upload still happened.

What is the clean version of the extension?

Anthropic published version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace. Whether and when Cursor's marketplace was restored hasn't been reported.

Sources

This article was compiled from reporting by the following outlets. Links go to the original reports.

1. The Hacker News: Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
2. BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors
3. Reuters: Cursor says up to 5,000 users affected by tampered Claude Code extension
4. The Register: Anthropic: That Claude Code extension compromise… couldn't be us