Cursor says a tampered build of Anthropic's Claude Code extension, version 2.1.313, was available in the Cursor extension marketplace for about 11 hours on Oct. 29, and that it tried to install a backdoor on users' machines. In its security notice, Cursor says at most 5,000 users were affected and that it will contact them directly.

What Cursor says happened

  • Window: the malicious version was available from about 2:27 a.m. to about 1:35 p.m. Pacific on Oct. 29, 2026.
  • Not from Anthropic: Cursor says Anthropic did not develop this version. Cursor's notice carries no statement from Anthropic, and we have not seen one.
  • What it did: Cursor says it collected details about the computer and user, including hostname, username, operating system and public IP address. It also tried to add an attacker's SSH key, turn on the local SSH service and open a reverse SSH tunnel, then keep itself running on macOS and Windows.
  • Limits on the damage: Cursor says the SSH step would generally fail unless Cursor was running with administrator rights, but the key and the persistence steps could still be set up.
  • Cursor's response: it pulled the version, shut its marketplace as a precaution, audited access, rotated keys and rebuilt the marketplace. It says the attacker's server has been taken offline with the hosting provider. It says its audit confirmed no other extensions were tampered with, and it found no evidence that other versions or Anthropic's official distribution were affected.

What to do

Cursor's check looks for the attacker's SSH key, labeled "svc-telemetry", in your SSH authorized-keys file.

  1. Think back: did you install or update the Claude Code extension in Cursor on Oct. 29, between those times?
  2. Run Cursor's check: the notice gives a macOS command and a Windows PowerShell command that search for the key. Use the ones in the notice rather than a copy from anywhere else.
  3. If you find the key: Cursor says to isolate the machine, remove the key, the persistence items and the tunnel processes, and decide whether to rebuild the machine. It publishes remediation scripts for macOS and Windows that do the removal.
  4. Rotate credentials: change passwords, keys and sessions that the machine could reach, from a different, trusted computer. Cursor says the limited data it collected does not rule out later access to credentials.

Uninstalling the extension is not enough on its own, Cursor says, because separate scripts the extension drops can keep running.

What is confirmed and what is not

Cursor's "at most 5,000" is a ceiling for users who had the build, not a count of hacked machines. Cursor does not say how many machines actually ended up with a working backdoor, and we have not seen any independent figure. Help Net Security, which reports the same incident, also carries no statement from Anthropic and does not say any specific user was compromised.

Related

Another case of malicious software reaching devices through a trusted channel is Midnight Mimosa malware preinstalled on cheap Android phones. For another Anthropic tool that runs on your own machine, see Claude Duet, a proactive agent. More is in AI & Apps.