Tampered Claude Code Extension on Cursor Tries to Plant SSH Backdoor

What happened

According to Cursor's security notice, a modified copy of Anthropic's Claude Code extension was live in Cursor's own VS Code extension marketplace on 29 October 2026, between about 2:27am and 1:35pm Pacific time. The notice names version 2.1.313, and a later Microsoft analysis also names version 2.1.312. Cursor says at most 5,000 users were affected.

Cursor says the code was built to add an attacker-controlled SSH key to the computer, switch on the local SSH service and open a reverse tunnel back to a server the attacker controls. It also sent host details to that server. Cursor notes that switching on SSH normally needs administrator rights, which the extension lacks on most macOS and Windows machines, so the step would usually fail. The key was still added in many cases, which is why Cursor asks every affected user to clean up.

Anthropic said that a malicious actor used access to Cursor's marketplace to publish a copy it did not build or publish, and that its own systems and employee laptops were not compromised. Neither Cursor nor Anthropic has said publicly how that access was obtained, according to The Next Web. Early reports also named the Open VSX registry. The Hacker News later corrected its story, and the security firm Socket said its review found no sign that the build reached Open VSX.

Why it matters for businesses that automate work

The build carried the real extension name and publisher identity, so a standard update from the marketplace could deliver it. The Hacker News noted that the package did not arrive as a separate fake extension. Any company that lets staff install editor add-ons, or that runs automated tools on developer laptops, should treat extensions as software that needs an inventory and an update policy.

Automation tools share the rights of the account they run under. A backdoor on a developer machine can reach whatever that machine can reach. Cursor's notice also says that the limited data collected by the code does not rule out later credential access over the backdoor.

Who is affected and who is not

The table below summarises what Cursor and Microsoft say about each channel.

What changes in practice

For a business with a few developers, the job is a short check on each laptop. For a larger group, the same check should run across the fleet and be logged. The steps below follow Cursor's guidance.

1. List every machine where the Claude Code extension was installed or updated in Cursor on 29 October 2026.
2. Remove the unauthorised SSH key, the persistence items and any running tunnel processes, using the remediation scripts Cursor published.
3. Uninstall the extension and update to version 2.1.314 or later, since uninstalling alone may not stop the persistence scripts that the payload left behind.
4. Decide, for each affected machine, whether it should be rebuilt. Cursor says this should be assessed.
5. Rotate any passwords, tokens or keys that were stored on or used from those machines, because the notice does not rule out later credential access.

Automation can help with the first step. A scheduled script can read installed extension versions, match them against the vendor's published list and send a report to an operations lead. It cannot confirm that a machine is clean, and it cannot decide whether a rebuild is worth the cost. A person still reviews each flagged machine and signs off the outcome.

What to watch next

Three things are still open. Cursor has not published how the malicious copy reached its marketplace, so the root cause is not yet known. Microsoft's analysis says the incident appears limited to Cursor's marketplace, but that view depends on the evidence available so far. Finally, the indicators Cursor and Microsoft publish may be updated as investigators examine the payload, so the checks that matter most are the ones tied to the published version numbers and the SSH key label.