The Claude Code Extension Backdoor That Lived in Cursor's Own Marketplace for 11 Hours

A Claude Code extension backdoor sat live in Cursor's own VS Code extension marketplace for about eleven hours on October 29, 2026, reaching up to 5,000 developer machines before anyone caught it. The unsettling part isn't that a malicious extension existed. It's that there was nothing to catch by checking the publisher: this was published through Anthropic's own account, under the real extension's identifier, with a legitimate-looking version bump.

Jump to why checking the publisher didn't help this time if you want the core lesson first.

What Actually Shipped

According to BigGo's technical summary, the compromised releases were versions 2.1.312 and 2.1.313 of anthropic.claude-code, distributed specifically through Cursor's own VS Code extension marketplace between roughly 2:27 a.m. and 1:35 p.m. Pacific time. The separate Open VSX registry listing, the Microsoft VS Code Marketplace build, and the @anthropic-ai/claude-code npm package were all confirmed clean. Only the copy living in Cursor's marketplace was tampered with.

Datastudios' published indicators of compromise describe a 66-line loader inserted ahead of the legitimate extension code. On load, it collected hostname, username, environment variable names, configured Git email, and public IP, then sent that reconnaissance data over an unencrypted HTTP POST to a beacon endpoint at 134.209.82.225:8099/beacon. From there it attempted to append an attacker-controlled SSH key, labeled with the comment svc-telemetry, to the user's authorized_keys file, enable the local SSH service, and open a reverse tunnel back to the same attacker-controlled server, with persistence installed through a macOS LaunchAgent or a Windows scheduled task named SysMon.

Why Checking the Publisher Didn't Help This Time

Phorion's CTO Luke Roberts told Ars Technica, "it was a supply-chain compromise where the attacker gained access to the official distribution channel." Researcher Kevin Beaumont confirmed version 2.1.313 was distributed through Anthropic's own official publisher account on Cursor's marketplace. Anthropic has stated it "was not involved with building, publishing, or hosting" the tampered extension, but neither company has publicly explained how the attacker obtained control of that account or distribution channel.

That distinction matters more than it sounds. Verifying a publisher's identity, the standard advice for avoiding supply-chain attacks, would not have flagged this extension, because the publisher genuinely was the real one. As one researcher put it in the same Help Net Security report: "there was no impersonation to spot... Increasingly, it's agents and automatic updates installing these things, not humans. Checking the publisher name doesn't help when the publisher is real."

The Step That Actually Failed, and Why It Saved Most Machines

Implicator's reporting and TechBytes' summary both confirm the detail that limited real-world damage: enabling the local SSH daemon requires administrative privileges on both macOS and Windows, and the extension ran under a standard developer user account on the vast majority of affected machines. The reconnaissance, the attempted key injection, and the persistence mechanisms still executed. The attacker's final step, logging in through the tunnel, largely did not, because operating-system privilege boundaries held even though the application-layer trust model didn't.

This is worth sitting with: the thing that actually protected most of the 5,000 potentially affected developers wasn't a security product. It was a privilege boundary the extension couldn't cross by default. Where that boundary is weaker, misconfigured, or deliberately disabled, the outcome looks very different.

What Cursor Did After Discovery

According to Cursor's own security notice, the company pulled the compromised versions, took its entire VS Code marketplace offline, audited for other tampered extensions, and found none. It then rotated its keys and rebuilt the marketplace, and worked with the hosting provider running the attacker's server to take it offline, cutting off both the reverse tunnel and the reconnaissance beacon.

Anthropic shipped a clean version, 2.1.314, to supersede the compromised version numbers. Cursor also warned that uninstalling the extension alone does not remove the backdoor, since the payload drops standalone persistence scripts that keep running independently, and it published cleanup commands for the specific indicators of compromise.

What This Means for Anyone Running AI Coding Tools

Our verdict: this incident doesn't mean Cursor's marketplace, or extension marketplaces generally, can't be trusted. It means publisher verification, the thing most of us actually rely on day to day, failed to be a meaningful signal here, because the compromise happened inside the legitimate distribution channel rather than through a lookalike package. That's a harder problem than typosquatting, and it doesn't have a checklist fix.

• If a coding-agent extension needs real shell access, give it a disposable one, not your real machine. An extension running inside an isolated, throwaway virtual machine with its own kernel can still get compromised, but a planted SSH key and reverse tunnel land on something you can delete in seconds, not on the laptop holding your actual credentials and source history.
• Auto-update is the attack surface here, not a convenience feature you can ignore. The compromised version reached users specifically because extensions update themselves by default; a malicious release doesn't need you to click anything.
• Don't treat "it's the official extension" as the end of the verification question. This extension genuinely was official. The account behind it, not the package name, is what got compromised, and that's a distinction most verification habits don't check for.

FAQ

What happened with the Claude Code extension in Cursor's marketplace?

A tampered version of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, was distributed through Cursor's own VS Code extension marketplace for about 11 hours on October 29, 2026, reaching up to 5,000 developer systems. The compromised build attempted to install an SSH backdoor, open a reverse tunnel to an attacker-controlled server, and establish persistence, while sending host reconnaissance data to that same server.

Was the Claude Code extension backdoor caused by Anthropic?

No. Anthropic stated it was not involved with building, publishing, or hosting the tampered extension. The compromised versions were distributed through Anthropic's own official publisher account on Cursor's marketplace, but neither Anthropic nor Cursor has publicly explained how an attacker gained control of that account or distribution channel.

Did the Claude Code extension backdoor actually let attackers access developer machines?

Partially. The extension successfully ran host reconnaissance, attempted to plant an SSH key, and installed persistence mechanisms on affected machines. However, enabling the local SSH service requires administrative privileges that the extension lacked on most macOS and Windows machines running under standard developer accounts, so the attacker's final step, logging in through the reverse tunnel, failed on the majority of affected systems.

What We Checked Before Publishing

We pulled BigGo's and Datastudios' published technical indicators of compromise directly, cross-referenced the exposure window and affected-user estimate against Help Net Security's, Implicator's, and TechBytes' independent reporting, and confirmed all four sources agree on the core timeline. How the attacker originally gained access to Anthropic's publisher account on Cursor's marketplace remains publicly unexplained by either company, and we've left that as an open question rather than guessing at a cause.

I'm Rohit, founder of Krova Cloud: our own MCP server is built specifically for Claude and Cursor, and the reason we built it to spin up a disposable Cube per agent is exactly this kind of incident. A compromised extension or agent with shell access inside an isolated, throwaway microVM can still plant a key and try to phone home, but it isn't your real machine, your real SSH config, or your real credential store on the other end. More debugging stories at debugly.dev.

Structured Data

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "BlogPosting",
      "headline": "The Claude Code Extension Backdoor That Lived in Cursor's Own Marketplace for 11 Hours",
      "datePublished": "2026-11-03",
      "dateModified": "2026-11-03",
      "author": {
        "@type": "Person",
        "name": "Rohit"
      },
      "about": ["Claude Code extension backdoor", "Cursor marketplace supply chain attack", "SSH reverse tunnel malware", "developer tooling security"]
    },
    {
      "@type": "FAQPage",
      "mainEntity": [
        {
          "@type": "Question",
          "name": "What happened with the Claude Code extension in Cursor's marketplace?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "A tampered version of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, was distributed through Cursor's own VS Code extension marketplace for about 11 hours on October 29, 2026, reaching up to 5,000 developer systems. The compromised build attempted to install an SSH backdoor, open a reverse tunnel to an attacker-controlled server, and establish persistence, while sending host reconnaissance data to that same server."
          }
        },
        {
          "@type": "Question",
          "name": "Was the Claude Code extension backdoor caused by Anthropic?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "No. Anthropic stated it was not involved with building, publishing, or hosting the tampered extension. The compromised versions were distributed through Anthropic's own official publisher account on Cursor's marketplace, but neither Anthropic nor Cursor has publicly explained how an attacker gained control of that account or distribution channel."
          }
        },
        {
          "@type": "Question",
          "name": "Did the Claude Code extension backdoor actually let attackers access developer machines?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Partially. The extension successfully ran host reconnaissance, attempted to plant an SSH key, and installed persistence mechanisms on affected machines. However, enabling the local SSH service requires administrative privileges that the extension lacked on most macOS and Windows machines running under standard developer accounts, so the attacker's final step, logging in through the reverse tunnel, failed on the majority of affected systems."
          }
        }
      ]
    }
  ]
}