Cursor Marketplace Served a Tampered Claude Code Extension With an SSH Backdoor
A modified copy of Claude Code sat in Cursor's extension store for about 11 hours and tried to plant an SSH backdoor. Anthropic says it was not breached, but Cursor says uninstalling the fake may not remove the damage.
Anthropic did not get hacked. That is the first thing to understand about the fake Claude Code that sat inside Cursor’s extension marketplace on Thursday, and the last thing Cursor users should take comfort from.
According to Cursor’s security notice, a maliciously modified copy of Anthropic’s Claude Code extension was available to download between about 2:27am and 1:35pm Pacific on October 29. That is roughly 11 hours. Cursor says the tampered versions were "not developed by Anthropic" and estimates up to 5,000 people may have installed it, a figure The Verge also reported.
Anthropic was quick to draw the line. Felix Rieseberg, a member of its technical staff, posted a statement that The Register quoted in full:
"A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected, and this only impacts Cursor users." Felix Rieseberg, Anthropic
Read that carefully. Anthropic is saying the weak point was the store, not the software maker. Cursor has not said how the attacker got a package into its marketplace, and The Register noted that neither company has explained it. That is the question that matters most, and nobody has answered it yet.
A backdoor that outlives the uninstall
Cursor says the extension tried to do four things. It collected the hostname, username, operating system, home directory, environment variable names, working directories, Git email and public IP address. It tried to add an attacker-controlled SSH key, labeled svc-telemetry, to the user's authorized keys. It tried to switch on the local SSH service and open a reverse tunnel back to the attacker. And it tried to make that tunnel persistent, using a LaunchAgent on macOS or a scheduled task on Windows, with background scripts retrying about every 60 seconds.
The part that should make security teams wince: Cursor warns that "uninstalling the extension may not be sufficient," because the payload drops standalone persistence scripts that keep running on their own.
The attacker did get one break. Cursor says turning on the SSH service needs admin rights, and because of errors in the malicious code that step fails on most Mac and Windows machines unless Cursor was launched with administrator privileges. On those machines, Cursor says, the attacker could not log in through the tunnel. Even so, the company says the extension still added the key, installed persistence and sent host details to the attacker. Cursor says it worked with the hosting provider to take the attacker's server offline, so the tunnel and the data upload no longer work.
Security vendor Ox Security, which published its own analysis, put the lesson bluntly:
"A poisoned update to a trusted extension is code execution on the developer’s machine." Ox Security
That is a vendor's framing, but the mechanics back it up. Per Ox, nobody had to click a suspicious link or be tricked by a prompt. The package carried a trusted name, arrived through the editor's own store and ran when the editor loaded it.
Two details are still messy. Cursor’s notice, updated Friday, lists versions 2.1.312 and 2.1.313 as malicious, while Ox, Sophos and The Register refer only to 2.1.313. And attribution is a blank: The Register describes the culprit only as an unknown party. Nobody has publicly said who is behind it.
For Cursor, the cleanup was drastic. The company says it removed the bad version, shut down the whole marketplace as a precaution, audited access, found no evidence other extensions were tampered with, rotated its keys and rebuilt the store. That is a fair response. It is also an admission of how much trust one marketplace carries.
Coding agents now sit close to SSH keys, cloud tokens and source code, so their add-ons are an obvious target. A fake "official" extension is cheaper than breaking into an AI lab, and this one reached thousands of machines without touching Anthropic at all. Developers who installed Claude Code from Cursor that day should follow Cursor’s check for the svc-telemetry key, and if it turns up, treat the machine as compromised and rotate credentials from a clean system, as Cursor advises.
