Trojanized Claude Code extension on Cursor's marketplace planted SSH backdoors on up to 5,000 machines

For about 11 hours on October 29, 2026, installing or auto-updating the official Claude Code extension through Cursor's VS Code Extension Marketplace could silently hand you a backdoored build — published under Anthropic's own extension ID, not a lookalike package.

What the source says

Per Cursor's own security notice, a malicious actor obtained publishing access to Cursor's marketplace and pushed tampered builds (versions 2.1.312 and 2.1.313, for darwin-arm64 and win32-x64) of the anthropic.claude-code extension. The versions were live roughly 2:27am-1:35pm PT before Cursor pulled them.

On execution, the tampered build harvested hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP, and sent them to an attacker-controlled server. It then attempted to write an attacker key (labeled svc-telemetry) into authorized_keys, enable the local SSH service, and open a persistent reverse SSH tunnel — retrying roughly every 60 seconds, with OS-specific persistence (a macOS LaunchAgent, a Windows SYSTEM-level scheduled task, falling back to the Startup folder).

Cursor estimates up to 5,000 users could have installed or updated to an affected version during the window. Its notice is explicit that the SSH-key and persistence steps "would usually fail without administrator privileges" on most setups — but the recon payload needed no elevated access and had already reported home regardless. Cursor pulled the version, shut down and rebuilt its marketplace, rotated its own keys, audited for other tampered extensions (finding none), and worked with the attacker's hosting provider to take the server offline. Anthropic said the builds were "not developed by Anthropic" and its own official distribution was unaffected.

What it doesn't establish

Neither company has publicly explained how the attacker obtained marketplace publishing access in the first place — that's the actual root cause, and it's still unknown. Cursor's notice doesn't say how many of the up-to-5,000 exposed users actually had the SSH/persistence steps succeed versus merely having their host data exfiltrated; it recommends remediating regardless, since uninstalling the extension alone can leave a planted key or persistence script behind.

Why this one is scored critical

We log this at 10/critical: scope 4 (mass exposure across a public marketplace, not one org), recoverability 3 (host info was already sent before Cursor could react — that exposure is permanent regardless of later cleanup), realisation 2 (this happened on real developer machines, not in a test), impact 1 (held down from higher because the SSH/persistence steps likely failed without admin rights on most machines). Full factor breakdown and source: https://www.stupidllm.com/incident/STUPID-2026-0157/

The pattern worth noticing: this wasn't a prompt-injection or a model doing something unwanted — it's a supply-chain compromise of the distribution channel itself. "The extension ID says Anthropic" turned out not to be a security boundary on a third-party marketplace, and no amount of careful prompting or agent-scoping would have caught it. The exposure came from installing, not from using.