Cursor confirmed that weaponized builds of the Claude Code extension briefly appeared in its Visual Studio Code extension marketplace on October 29, 2026. For roughly eleven hours those tampered packages attempted to harvest host details and install an SSH backdoor intended to provide persistent remote access. Cursor says the compromised builds were not produced by Anthropic and that distribution was limited to specific versions of the extension.
Timeline and affected builds
Cursor’s security notice identifies the impacted releases as Anthropic.claude-code versions 2.1.312 and 2.1.313. The malicious packages were available from about 2:27 a.m. to 1:35 p.m. Pacific Time on October 29, 2026 — an exposure window of approximately 11 hours and eight minutes. After discovering the issue, Cursor removed the altered packages, paused the marketplace, and carried out a remediation and review process.
What the malicious code did
The injected payload performed initial collection of host metadata, including hostname, username, operating system, processor architecture, home directory, working directories, configured Git email, public IP address, and environment variable names (the notice emphasizes variable names rather than their values). In addition to reconnaissance, the code attempted to establish persistent access by adding an attacker-controlled SSH public key labeled svc-telemetry to authorized_keys, enabling the local SSH service, and creating a reverse SSH tunnel that would route connections from the attacker’s server back to the victim’s machine.
The malware used platform-specific persistence mechanisms. On macOS it deployed a LaunchAgent named com.apple.sysmond. On Windows it tried to schedule a task named SysMon to run as SYSTEM, falling back to a Startup-folder script if necessary. Background scripts were written to retry connections about every 60 seconds.
Limitations on attacker access
Cursor reported that coding errors and the lack of elevated privileges on most hosts prevented successful interactive remote logins in many cases. Enabling SSH typically requires administrative rights that the extension process did not possess. Nonetheless, those limitations did not stop the collection of host information or the execution of other malicious modifications.
Cursor’s incident response
After detecting the tampered packages, Cursor removed them from the marketplace, blocked further distribution, temporarily shut down the marketplace to contain risk, audited access, rotated keys, rebuilt the marketplace infrastructure, and restored service. Cursor also coordinated with the hosting provider to disable the attacker’s server. Their review found no signs that other Claude Code versions or the official distribution had been altered.
Indicators and investigative guidance
Cursor published indicators to support detection and response. Those include the IP address 134.209[.]82[.]225, SSH activity on TCP port 22, and HTTP POSTs to port 8099 at the /beacon path. Teams should inspect authorized_keys for an entry labeled svc-telemetry, review extension installation records, and check endpoint alerts and network logs for the listed indicators.
Cleanup and mitigation recommendations
Because the extension’s removal alone may not eliminate leftover scripts or persistence mechanisms, affected hosts that show evidence of payload execution or backdoor installation should be isolated. Follow platform-specific cleanup guidance where available, rotate any credentials and sessions that may have been accessible from compromised machines using a trusted system, and evaluate whether full system rebuilds are required. Organizations should also review installation sources and monitoring around developer tooling to reduce supply-chain risk.
Final note
This incident follows a pattern in which trusted developer tools and extensions are used to deliver malicious code. While Cursor’s containment steps and coordination with infrastructure providers reduced the immediate threat, the episode underlines the need for vigilance around extension provenance, marketplace security, and rapid response capabilities.
Licensed under CC BY-ND 4.0 International