On 29 October 2026, Cursor's extension marketplace served a tampered copy of Anthropic's official Claude Code extension. According to Cursor's security notice, versions 2.1.312 and 2.1.313 distributed through its marketplace for macOS and Windows between about 2:27am and 1:35pm Pacific time were malicious. Cursor said the incident affected at most 5,000 users.
What happened
Cursor runs its own marketplace for VS Code extensions, which pulls from the Open VSX registry. During the window above, the Claude Code extension in that marketplace carried a small loader added to the top of its main file, so it ran before the real extension code. Microsoft's security team, which published its own analysis, says the tampered package was never distributed from the Visual Studio Marketplace or from npm. Socket, a supply chain security firm, found no evidence that version 2.1.313 was publicly available on Open VSX.
The Hacker News quoted an Anthropic security engineer saying the versions on Anthropic's official channels were not affected and that the incident only impacts Cursor users. Microsoft says Anthropic confirmed its systems were not compromised. How the attacker published the update under Anthropic's name on Cursor's marketplace has not been explained publicly. Cursor says it audited access, rotated its keys and rebuilt the marketplace.
What the malicious code did
Cursor, Microsoft and the research group OpenSourceMalware describe the same behaviour:
- It added an attacker SSH key labelled svc-telemetry to the user's authorized keys file.
- It set up persistence, using a LaunchAgent on macOS and a scheduled task on Windows, so it would run again after a restart.
- It tried to open a reverse SSH tunnel to an attacker server.
- It sent basic host details, including hostname, username, git email and public IP, plus the names of up to 40 environment variables that looked like secrets, without their values.
Cursor says turning on the local SSH service needs admin rights that the extension usually did not have, so that step would fail on most machines. It still warns that the limited data collection does not rule out later access through the back door.
Why uninstalling is not enough
The malware wrote files outside the extension's own folder. Microsoft states that removing or updating the extension does not remove those artifacts, and Cursor says uninstalling may not be sufficient. The SSH key and the startup task stay behind until you remove them.
How to check your machine
You are in scope if you use Cursor on macOS or Windows and installed or updated the Claude Code extension in that window. Cursor's notice gives a one-line check for macOS, which looks for the attacker key:
- Run grep -qs svc-telemetry ~/.ssh/authorized_keys and see whether it reports a match. Cursor's notice prints "key found" or "no key found" with a slightly longer version of this command.
- On Windows, use the PowerShell version in Cursor's notice, which checks both the user and administrator key files.
If no key is found, Cursor says the machine is not impacted. If the key is there, Cursor recommends running its remediation script, isolating the machine, removing the key, persistence and tunnel processes or rebuilding the machine, and rotating any credentials the machine could reach from a separate, trusted computer.
What to do this week
If anyone on your team uses Cursor, ask them to run the check today, and treat a positive result as a full security incident. More broadly, list which extension marketplaces your editors install from, because an AI coding tool is only as safe as the place its updates come from. If you are setting up Claude for coding, our Claude guide in Learn covers the official install options.