Malicious Claude Code build reached up to 5,000 users through Cursor's marketplace

Cursor, the AI code editor, said in a security notice that a malicious version of Anthropic's Claude Code extension appeared in its extension marketplace. Version 2.1.313 was available for about 11 hours on October 29, 2026, between 09:27 and 20:35 UTC. Cursor says at most 5,000 users were affected and that it will contact them directly. According to the company, Anthropic did not develop this version. The package still shipped under the extension's official ID, anthropic.claude-code, so users saw it as a routine update.

What the code did

According to Cursor, the modified extension collected details such as the hostname, username, operating system, Git email and public IP address. It tried to add an attacker's SSH key to authorized_keys, turn on the SSH service and open a reverse tunnel to the attacker's server. It used a LaunchAgent on macOS and a scheduled task on Windows to keep the tunnel alive. The Hacker News reports that the data also included the names of environment variables containing terms such as KEY, TOKEN and SECRET. Their values were not part of the initial report sent to the attacker.

Cursor says turning on the SSH service requires administrator rights, which the extension lacks on most macOS and Windows machines. On those machines the attacker could not log in through the tunnel, but the key was still added, persistence was still installed and the host details were still sent. The attacker's server was taken offline with the help of its hosting provider.

What affected users should do

Cursor advises anyone who installed or updated to this version to search authorized_keys for a key labeled svc-telemetry. If the key is there, the machine should be isolated, the company's cleanup scripts should be run, and passwords, keys and sessions reachable from that machine should be replaced from a trusted system. Removing the extension may not be enough, since the code leaves standalone persistence scripts behind. A clean version, 2.1.314, is out.

Cursor removed the version, shut down the marketplace entirely, checked that no other extensions had been changed, rotated its keys and rebuilt the marketplace before bringing it back. How the package got in is still unknown. Sources also differ on the route: The Hacker News says it appeared only in Cursor's marketplace, while StepSecurity says it was first published to Open VSX and reached Cursor from there. These details may change as the review continues.

Sources: Cursor, The Hacker News, StepSecurity, OX Security