A tampered Claude Code update tried to plant a backdoor on developers’ computers — what Cursor users need to check

For about eleven hours on 29 October 2026, developers who updated Anthropic’s Claude Code extension inside the Cursor editor could have received a modified copy that looked ordinary — right name, publisher and version number — but tried to collect information from the computer, plant a hidden way back in, and keep that access alive after a restart.

Cursor said the tampered build was not developed by Anthropic. Anthropic agreed, saying its own systems were not compromised. This was a supply-chain attack: not a break-in at the company that makes the tool, but a fake copy slipped into the shop that delivers it.

That distinction changes who needs to worry. People who use Claude Code in a terminal, in Microsoft’s Visual Studio Code, or through Anthropic’s own channels were not in scope. People who updated the extension inside Cursor on 29 October need to check their machines, even if everything still seems to work.

At a glance

What happened: A tampered copy of Anthropic’s Claude Code extension, versions 2.1.312 and 2.1.313, was available in Cursor’s extension marketplace for about eleven hours on 29 October 2026, and tried to install a persistent SSH backdoor on developers’ computers.
Why it matters: The fake build used the extension’s real identity, so it could arrive as an ordinary automatic update, and simply removing the extension does not remove the hidden access it tried to leave behind.
What happens next: Cursor has removed the tampered versions, rebuilt its marketplace and published clean version 2.1.314, while affected users are being told to check for a specific SSH key, run Cursor’s cleanup scripts and rotate credentials from a clean machine.

What happened

Cursor published its security notice on 29 October 2026. It said a maliciously modified version of Anthropic’s Claude Code extension, versions 2.1.312 and 2.1.313 for Windows and macOS, had been available in the Cursor VS Code Extension Marketplace between about 2:27am and 1:35pm Pacific Time that day — 09:27 to 20:35 UTC, about eleven hours.

Cursor said at the time that at most 5,000 users were affected. That figure came from Cursor’s own statement on 30 October, reported by Reuters. Read it exactly as Cursor worded it: an upper limit on how many users received the tampered build, not a count of machines successfully broken into. Cursor’s updated notice, revised on 30 October at 11:30am Pacific Time, no longer gives a user count.

Cursor’s notice first named only version 2.1.313. The 30 October update added version 2.1.312 as well, with file hashes for both — so anyone checking only for 2.1.313 would miss a machine that received the tampered 2.1.312 build.

There is a second trap in the version numbers. Version 2.1.312 is also a genuine Anthropic release, published to the Open VSX registry on 27 October. StepSecurity downloaded the Open VSX copy and verified that it was clean. The malicious 2.1.312 existed only in Cursor’s marketplace, as a different file carrying the same version number. The version number alone does not prove a machine is affected; the check that matters is whether the attacker’s key and persistence files are present.

Anthropic skipped version 2.1.313 in its official releases and published the clean replacement, version 2.1.314, on 30 October. Updating to it does not, on its own, clean a machine that already received the bad build.

How the backdoor worked

The tampered build was, in almost every respect, the real extension. StepSecurity found the malicious file was roughly 7 kilobytes larger than the previous clean release. Researchers described a small loader — about 66 lines of code, according to the OpenSourceMalware analysis — placed at the start of the extension’s main JavaScript file, extension.js. Because the loader ran when the extension was loaded, a user did not need to start a Claude conversation, or even use the extension, for it to act.

Cursor’s notice describes what the code then attempted to do. First, it collected information about the machine and its user: hostname, username, operating system, home directory path, environment variable names, Git email and public IP address. Second, it tried to add an attacker-controlled SSH key, enable the local SSH service and open a reverse SSH tunnel to an attacker server. Third, it tried to make that tunnel persistent, so it would survive a restart.

SSH, or Secure Shell, is a standard way to log in to a computer over a network and run commands on it. An SSH key works like a spare key to a house: anyone holding the matching private key can open the door without a password. A reverse SSH tunnel lets the compromised machine call out to the attacker’s server and hold the line open, so the attacker can walk back in along it — even behind a firewall. Cursor said the tunnel pointed to the server at 134.209.82.225, and the code also sent host details to that address over plain HTTP.

The persistence step is what makes this harder to clean up than an ordinary bad download. On macOS, the code tried to install a LaunchAgent — an instruction macOS runs automatically at login — under the label com.apple.sysmond. On Windows, it tried to create a scheduled task called SysMon, with a script in the Startup folder as a fallback. Background scripts then retried the tunnel roughly every 60 seconds.

There was an important limit on most machines. Turning on the local SSH service requires administrator rights, which the extension does not normally have on macOS or Windows. Cursor said that outside of highly unusual circumstances where Cursor was started with administrator privileges, and because of errors in the malicious code, that step would fail. On those machines, the attacker could not have logged in through the tunnel. But Cursor added that this did not make the machines safe: the extension still added the attacker’s SSH key, installed the persistence mechanisms and sent host details to the attacker. The code collected the names of environment variables, not their values — but those names can still reveal which credentials exist, so StepSecurity advises rotating credentials reachable from an affected machine from a trusted, clean system.

Why the real extension ID mattered

This attack was unusually convincing because it did not rely on a lookalike. The tampered build was published under the legitimate extension identifier, anthropic.claude-code, not a misspelt copycat name. A developer glancing at an update prompt would have seen the name and publisher they trusted, at a version number that followed naturally from the previous release.

That is why the usual advice — check the publisher, beware of typos — would not have helped. The software came from a known source, through a normal update. The only visible clue was a version number, 2.1.313, that did not exist on Anthropic’s official channels.

The incident also shows how much trust is concentrated in an extension marketplace. Cursor runs its own marketplace for the Cursor editor, which is built on Microsoft’s Visual Studio Code. Installing or updating an extension means trusting not only its author, but the marketplace’s checks on who may publish under that author’s name. Cursor has not explained how the tampered package got into its marketplace, and neither Cursor nor Anthropic had publicly established that route by 31 October. That gap is now the central unanswered question.

The security firm Phorion was the first to spot the altered package, according to The Register, and StepSecurity and OpenSourceMalware published independent analyses that reached the same conclusion about the payload.

What was not affected, and what Anthropic said

Early headlines caused confusion, with some reports suggesting Anthropic itself had been hacked. Anthropic corrected that on 30 October: Felix Rieseberg, a member of its technical staff, said the incident was not a compromise of Anthropic’s systems or employee laptops, and that a malicious actor used access to Cursor’s marketplace to publish a tampered copy Anthropic did not build or publish.

Anthropic also confirmed that version 2.1.313 was never published to Open VSX, the Microsoft Visual Studio Marketplace or any of its official hosts. StepSecurity checked those registries independently and found the same pattern. Cursor’s notice draws the same boundary, saying it has no evidence that other versions, other extensions or the official distribution were affected.

One detail changed during 30 October, and it is worth recording. Some first analyses said the tampered build had come from Open VSX, the open registry used by VSCodium, Cursor, Windsurf and Gitpod. By the end of the day that account had been corrected: Anthropic said the build was never published to Open VSX or the Microsoft Marketplace, and StepSecurity updated its post to say the tampered build existed only in Cursor’s marketplace.

What Cursor did next

Cursor said it removed the malicious version immediately upon detection and blocked further distribution. It then shut down the whole marketplace as a precaution, audited access and confirmed no other extensions had been tampered with. It rotated its own keys, rebuilt the marketplace and brought it back online. It also worked with the cloud provider hosting the attacker’s server to take that server offline, so the reverse tunnel and the host-detail reports no longer function. Cursor said it would contact affected users directly.

Shutting down an entire marketplace is a drastic step: it stops every legitimate update until the service is rebuilt and checked. Cursor’s decision to do that, rather than simply deleting one file, suggests it could not immediately be sure the tampered package was the only problem.

What to do if you use Cursor

The advice below follows Cursor’s security notice and StepSecurity’s remediation guidance. It is general information, not a guarantee that a machine is clean, and anyone responsible for a work machine should involve their employer’s security team.

First, work out whether you are in scope. You are in scope if you installed or updated Anthropic.claude-code to version 2.1.312 or 2.1.313 from Cursor’s marketplace on macOS or Windows between about 2:27am and 1:35pm Pacific Time on 29 October 2026. If you did not take that update in that window, you are unlikely to be affected.

Second, check for the attacker’s SSH key. The key is labelled svc-telemetry, and it is the single fastest indicator. Cursor gives a one-line macOS command and a PowerShell check for Windows in its notice. If the key is found, the machine is affected.

Third, do not stop at removing the extension. Cursor states plainly that uninstalling may not be sufficient, because the payload drops standalone persistence scripts that keep running after the extension is gone. Cursor publishes a remediation script for macOS and one for Windows that remove the extension, the persistence mechanisms, the running tunnel processes and the attacker’s SSH key. Run the script for your platform, from Cursor’s notice, rather than a copy passed around on social media.

Fourth, rotate credentials from a clean machine. Change passwords, tokens and keys that could have been reached from the affected computer, and do it from a computer known to be clean. If the tunnel is confirmed to have connected, particularly where SSH was already switched on, StepSecurity advises that rebuilding the host is safer than trying to clean it.

Fifth, update the extension to the clean version. Cursor asks all customers to update to Claude Code for VS Code version 2.1.314. Do that after the cleanup, not instead of it.

For teams, the incident is a prompt to check how extensions are managed across many machines: which machines took a particular version on a particular day, and a sweep for the same indicators — the svc-telemetry key, the persistence files, and any traffic to 134.209.82.225. Do that now, while the indicators are fresh. An AI coding assistant necessarily has deep access to a machine, so a tampered copy is far more dangerous than a tampered colour theme. For Pakistan’s developers and startups, the lesson is direct: many use the same tools on personal machines that also hold client code and cloud credentials, and checking for the svc-telemetry key takes a minute.

Frequently asked questions

Was Anthropic hacked?

No, according to Anthropic and the independent checks published so far. Anthropic said a malicious actor used access to Cursor’s marketplace to publish a tampered copy, and its own systems and official channels were not affected.

I use Claude Code, but not in Cursor. Am I affected?

On the evidence available by 31 October, no. The tampered versions were in Cursor’s own marketplace only. If you also use Cursor, check that installation separately.

Does updating to version 2.1.314 clean my machine?

No, not on its own. Updating replaces the extension’s files, but Cursor says the payload drops standalone persistence scripts that keep running after the extension is removed. Affected users need to run Cursor’s remediation script, remove the attacker’s SSH key and persistence mechanisms, and rotate credentials from a clean machine.

How do I know if my machine is affected?

Search for the SSH key labelled svc-telemetry in the authorised-keys file. Cursor publishes a one-line command for macOS and a PowerShell check for Windows in its security notice. If the key is found, the machine is affected. Also check for the persistence files listed in the notice, because the version number alone is not a reliable test.

Did the attacker actually get into affected computers?

That is not yet established, and the answer is likely to differ from machine to machine. Cursor said turning on the local SSH service requires administrator rights, which the extension does not have on most macOS and Windows machines, so that step would have failed on most affected computers. But the key was still added, persistence was still installed and host details were still sent. Machines where SSH was already switched on carry the real risk, and should be treated as compromised.

Who was behind the attack?

That is not known. Neither Cursor nor Anthropic had publicly named an attacker, or explained how the tampered package reached the marketplace, by 31 October.

Conclusion

In one sense this is a small story: a single tampered extension, available for eleven hours, reaching at most 5,000 users, with its most dangerous step failing on most machines. In another sense it is a warning about how software is now delivered: a trusted name and a familiar update were enough to put a backdoor on a developer’s computer.

If you updated Claude Code inside Cursor on 29 October, check for the svc-telemetry key today. If you find it, follow Cursor’s cleanup steps and rotate your credentials from a clean machine. If you do not find it, update to version 2.1.314. Trust in software is not only about who wrote it, but about every shop, registry and update channel it passes through on its way to your computer.

This article is for general information and education only. It is not legal or financial advice.

Sources

• https://cursor.com/blog/claude-code-extension-security-notice (Cursor, 29 October 2026, updated 30 October 2026)
• https://www.stepsecurity.io/blog/claude-code-extension-trojanized (StepSecurity, 30 October 2026)
• https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682 (The Register, 30 October 2026)