Cursor reports malicious Claude Code extension version

Cursor said the affected item was Anthropic.claude-code version 2.1.313 in its VS Code extension Marketplace.[1] It said the version was available from about 2:27 a.m. to 1:35 p.m. Pacific Time on October 29, 2026, and that at most 5,000 users were affected.[1] Cursor said the malicious version was not developed by Anthropic.[1] The Hacker News reported that the update appeared under the extension’s legitimate publisher identity, while the method used to introduce it remained unclear.[2]

Cursor said the extension collected host and user details, including the hostname, username, operating system, architecture, home-directory path, environment-variable names, working directories, configured Git email and public IP.[1] It attempted to add an attacker-controlled SSH key labeled “svc-telemetry” to the user’s authorized_keys file, enable local SSH and establish a reverse SSH tunnel.[1] It also attempted to keep the tunnel active using a macOS LaunchAgent or a Windows scheduled task, with a Startup-script fallback; background scripts retried roughly every 60 seconds.[1]

Cursor said enabling local SSH required administrator rights and would fail on most macOS and Windows hosts.[1] However, Cursor said the extension still added its key, installed persistence and sent host details to the attacker.[1] It reported host details and backdoor status through an HTTP POST to /beacon on port 8099.[1] Cursor said the attacker’s server no longer functioned, making the reverse shell and host-detail POST nonfunctional.[1] The Hacker News reported that no other follow-on payloads had been observed, while noting that a reverse tunnel could let an operator issue commands or transfer files.[2]

Cursor removed the malicious version, blocked further distribution and shut down its VS Code Marketplace as a precaution.[1] It said its audit found no other extensions had been tampered with, and that it rotated its keys, rebuilt the marketplace and brought it back online.[1] Cursor also said it worked with the hosting provider to take the malicious server offline and disrupt the attack.[1] It said it had no evidence that other extension versions or the official distribution were affected.[1] As of October 30, 2026, Anthropic had published version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace.[2] Cursor advised users to isolate hosts showing evidence of payload execution or backdoor installation.[1]