Claude Code Extension Backdoor Hit Cursor Users for 11 Hours

For roughly 11 hours on October 29, anyone who installed or updated Anthropic's Claude Code add-on inside the Cursor code editor could have received a tampered build. The Claude Code extension backdoor quietly added an attacker's SSH key to the computer and set up ways to come back after a reboot. Cursor says at most 5,000 users were exposed, and that the problem stayed inside its own extension marketplace.

The incident moved quickly across three companies: Cursor, which runs the marketplace, Microsoft, whose researchers took the payload apart, and Anthropic, whose name was on the package. The sequence below is drawn from Cursor's security notice, Microsoft's threat analysis and reporting by The Hacker News.

Eleven hours on Cursor's marketplace

• October 29, about 2:27 a.m. PT: A malicious build carrying Anthropic's extension ID, Anthropic.claude-code, goes live on the Cursor VS Code Extension Marketplace. Cursor lists builds labeled 2.1.312 and 2.1.313 for Windows and macOS as affected.
• October 29, about 1:35 p.m. PT: Cursor pulls the bad version. The company says it then shut the marketplace down, rotated keys, rebuilt the marketplace and had the hosting provider take the attacker's server offline.
• October 29: Cursor publishes its first security notice, with detection commands and cleanup scripts.
• October 30: Microsoft's security team publishes a detailed breakdown of what the extension did on infected machines.
• October 30, 11:30 a.m. PT: Cursor updates its notice and says it found no other tampered extensions in its store.
• October 30: The Hacker News reports that a clean 2.1.314 release is available.

What the tampered build did on each computer

Microsoft and Cursor describe the same chain of actions. First, the extension collected basic details about the computer and its user. Then it wrote a new SSH key labeled svc-telemetry into the user's authorized_keys file, which would let whoever held the matching private key log in remotely.

Next it tried to switch on SSH and open a reverse tunnel, a trick that lets an outsider reach the machine from the internet. It also checked in with a server at 134.209.82.225. To survive restarts, it planted a LaunchAgent named com.apple.sysmond on macOS, a cron job on Linux and a scheduled task named SysMon on Windows. Those names were chosen to blend in with real system services.

Cursor offers one piece of good news: on most Mac and Windows machines, the tunnel step would usually fail. The key and the startup items still get written, though, so a failed tunnel does not mean a clean machine.

Anthropic says its own channels were not touched

The package carried Anthropic's name, but the company says it did not build it. Microsoft wrote that "Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package." Microsoft also found no sign the build was ever published to the Visual Studio Marketplace or npm.

According to The Hacker News, Anthropic said on X that the versions on its official channels, including VS Code and OpenVSX, were not affected and that only Cursor users were. Based on everything published so far, developers who run Claude Code in Microsoft's VS Code or in a terminal are outside this incident.

What nobody has explained is how the attacker got a build published under Anthropic's extension ID on Cursor's store. Cursor has not said, and the answer matters for every extension it hosts. It is the same weak spot we flagged with the malicious AGENTS.md file that fooled Codex: AI coding tools now run with deep access to developer machines, which makes them an attractive way in.

Checking a Mac or Windows PC that runs Cursor

If you used Claude Code inside Cursor on October 29, check your machine even if you have updated since. Cursor and Microsoft both warn that uninstalling the extension may not be enough, because the key and startup items stay behind.

1. Look for the key. On a Mac or Linux machine, search ~/.ssh/authorized_keys for the text svc-telemetry. Cursor's notice gives an equivalent PowerShell command for Windows.
2. If you find it, take the machine off the network before doing anything else.
3. Run Cursor's cleanup script for your system (remediate-macos.sh or remediate-windows.ps1), or remove the key, the com.apple.sysmond LaunchAgent, the cron entry or the SysMon task by hand.
4. From a different, trusted computer, change passwords and revoke tokens and sessions the affected machine used, including GitHub, cloud and API keys.
5. If it was a work laptop, tell your security team. Cursor takes reports at security@cursor.com.

Our explainer on what malware is and our guide to removing a virus from a Windows PC cover broader cleanup if you suspect anything else got in.

Developer tools are the new target

October has been busy for attacks that ride on software developers' trust. Microsoft separately linked Chinese hackers using the ARTEX framework to the ConnectWise breach, another case where a tool built for professionals became the entry point.

For Cursor, the next step is an explanation. Until it says how a stranger managed to publish under Anthropic's name, every extension on its rebuilt store asks users for a little more trust than it did a week ago. More coverage like this lives in our tech section.