Cursor Served a Backdoored Claude Code Update for 11 Hours, but the SSH Backdoor Failed on Most Machines

Cursor’s extension marketplace served a tampered build of Anthropic’s Claude Code extension for about 11 hours on 29 October, and Cursor says at most 5,000 users were affected. The package carried the official extension ID, anthropic.claude-code, and versions 2.1.312 and 2.1.313 for macOS and Windows. It tried to plant a persistent SSH backdoor the moment the editor loaded it.

The payload was not written by Anthropic, and Anthropic has told Microsoft that its own systems were not compromised. The compromise sat in Cursor’s distribution pipe, not in Claude Code’s source. Cursor removed the build, shut its marketplace, rotated keys, rebuilt the service and got the attacker’s server taken offline.

The backdoor mostly failed because the extension did not have administrator rights to switch on SSH on most hosts. The damage is elsewhere: a trusted update added an attacker’s key, installed persistence that survives uninstalling, and sent host details to a server for 11 hours.

Quick answer: If you installed or auto-updated Claude Code for VS Code through the Cursor Marketplace on 29 October, check for an SSH key labelled svc-telemetry in your authorized_keys file and update to version 2.1.314. The tunnel likely failed on most machines, but the key, the persistence scripts and the host reconnaissance did not need admin rights. Treat any confirmed hit as a credential exposure.

What Cursor actually served

Cursor’s security notice puts the window at 2:27am to 1:35pm Pacific Time on 29 October. That is 11 hours and 8 minutes, not the “few hours” some early writeups implied. The affected builds were the Darwin arm64 and Windows x64 packages. Cursor later added 2.1.312 to the advisory.

The version numbers matter because 2.1.312 was a real Anthropic release. Anthropic’s changelog jumps from 2.1.312 on 27 October to 2.1.314 on 30 October, with no 2.1.313 entry. The malicious 2.1.312 existed only on Cursor’s marketplace. Attackers did not need a new extension name. They reused the publisher identity developers already trusted.

Cursor has not explained how that happened. Its notice says the versions “were not developed by Anthropic” and that it found no evidence other extensions were tampered with, but it does not describe the entry point. Microsoft’s Threat Intelligence team reached the same conclusion: the incident appears limited to Cursor’s marketplace.

What the payload did, and why it mostly failed

Phorion, the macOS security firm that first dissected the package, found a 66-line loader prepended to the minified extension.js bundle. It runs as soon as Node loads the file, before Claude Code’s normal activation code, so the user does not have to open the extension or start a chat. Phorion’s writeup shows the loader appending an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys.

The key comment is svc-telemetry. The script tries to enable SSH, open a reverse tunnel to 134.209.82.225 on port 22, and keep it alive with a LaunchAgent on macOS, a scheduled task called SysMon on Windows and a cron entry on Linux. It retries roughly every 60 seconds. It also posts hostname, username, operating system, architecture, home directory, environment variable names, working directories, Git email and public IP to a beacon on port 8099.

Two bugs blunted it. On macOS the script checks Remote Login with systemsetup -getremotelogin without elevation. A standard user gets an admin-access error with exit status 0 instead of “Off”, so the script skips enablement entirely. On Windows, Phorion says the PowerShell service setup passes through a helper that hardcodes /bin/sh. Neither path includes a privilege escalation exploit.

Cursor concedes the point: outside unusual cases where Cursor ran with administrator privileges, the SSH step “would fail.” That still leaves the attacker’s key, persistence on disk and a stream of host metadata. If SSH was already running, the key alone was enough. Uninstalling the extension does not remove the standalone scripts, so Cursor published separate remediation scripts.

Where the malicious build did and did not appear

Developers who installed Claude Code through Microsoft’s marketplace, Open VSX or npm are outside this incident. Cursor, VSCodium and Windsurf cannot use Microsoft’s marketplace because of licensing terms, so they depend on alternatives such as Open VSX or their own stores.

Confirmed vs not confirmed

As of 31 October, Anthropic had not published a public statement of its own. Its changelog and the 2.1.314 release are visible, and Microsoft says Anthropic confirmed the limited scope privately, but developers looking for an official advisory will not find one. That silence is a trust problem.

Why 5,000 is still a serious number

Five thousand is small next to Claude Code’s user base, and the failed SSH step makes for a less dramatic story than a full remote takeover. But each machine may hold cloud credentials, source code, publishing tokens, database connection strings and production SSH keys. The loader collected environment variable names to decide which hosts were worth revisiting.

Cursor says it is contacting affected users directly and has taken the attacker server offline, which stops the tunnel and the beacon. Neither action removes a key already in authorized_keys. Cursor’s guidance is to validate, isolate hosts showing execution, remove the key and persistence, rotate credentials from a trusted system, and consider rebuilding. Reinstalling the extension is not remediation.

We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions…

— Cursor (@cursor_ai) October 30, 2026

What it means for Indian developers

Indian engineering teams use Cursor and VS Code extensions heavily, often on managed laptops that auto-update without a change ticket. Most teams review npm dependencies and container images but treat the editor marketplace as trusted infrastructure. It is not. An extension runs with the developer’s permissions and can read every repository that developer can open.

Checks for this week: search endpoint telemetry for anthropic.claude-code versions 2.1.312 and 2.1.313 from Cursor’s marketplace, grep for svc-telemetry in ~/.ssh/authorized_keys and the Windows administrators file, and look for com.apple.sysmond or the SysMon scheduled task. Rotate GitHub, cloud and package registry tokens from a clean device for any host that shows execution. Pinning extension versions would have blocked this update.

Procurement should change too. Indian enterprises buying AI coding tools evaluate model quality, data residency and price. The extension supply chain rarely makes the questionnaire. Ask vendors how they sign extensions, whether they support version pinning, and how fast they would notify customers.

Frequently asked questions

Am I affected if I use Claude Code in the terminal?

Not through this incident. The malicious code was in the VS Code extension distributed by Cursor’s marketplace, not in the npm package or the CLI. Installs from Microsoft’s marketplace, Open VSX or npm are outside the affected channel.

Does updating to 2.1.314 remove the backdoor?

No. Updating replaces the extension but does not necessarily remove the SSH key, LaunchAgent, scheduled task or cron entry. Run Cursor’s remediation scripts, then check manually.

Was Anthropic hacked?

Anthropic says its systems were not compromised, according to Microsoft. The malicious builds were not developed by Anthropic and did not come from its official release pipeline.

Could attackers actually log in?

In most cases, probably not. Enabling SSH required administrator rights the extension did not have, and the macOS and Windows setup paths contained bugs. Risk is higher where SSH was already enabled.

Sources

• Cursor, security notice on the malicious Claude Code extension, 29 October 2026, updated 30 October 2026. cursor.com
• Microsoft Threat Intelligence, “Inside a malicious Claude Code-branded extension and its persistent SSH backdoor,” 30 October 2026. microsoft.com
• Phorion, “Official Claude Code Extension Compromise: Security Advisory,” 30 October 2026, updated 31 October 2026. phorion.io
• Cursor, statement on X, 30 October 2026. x.com
• Anthropic, Claude Code changelog, entries for 2.1.312 on 27 October 2026 and 2.1.314 on 30 October 2026. github.com

Related: Claude Mythos 5 pushed malware into a GitHub project and the PHP2Shell flaw that lets attackers run code on 70 percent of the web.