Cursor's own security notice says the file was genuine. It carried the real Anthropic.claude-code name, version 2.1.313, straight into the company's VS Code Extension Marketplace on Oct. 291. For about 11 hours, anyone who updated Claude Code through that marketplace got a hidden SSH backdoor along with it.
Cursor says up to 5,000 developers received the tampered file2. The company found it, pulled it, and shut the whole marketplace down the same day1.
The fake Claude Code update stayed live 11 hours before Cursor pulled it
Dated steps in Cursor's own account of the breach, Oct. 29 to 30, 2026
Each pin is one dated step on a line spaced by real time, from the first appearance of the tampered build to Cursor's own post confirming it.
Sources: Cursor [1]; Cursor (@cursor_ai) on X [2]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| Oct. 29, 2026 | Fake update appears. The trojanized Claude Code build appears in Cursor's marketplace at 2:27 a.m. PT |
| Oct. 29, 2026 | Cursor pulls it. Cursor removes the file at 1:35 p.m. PT, about 11 hours after it appeared |
| Oct. 30, 2026 | Cursor posts fix. Cursor posts on X confirming the breach and the 5,000-user ceiling |
A Real Extension, Hijacked
Most fake software tricks a buyer with a similar name. This attacker skipped that step entirely. Reaching Cursor's own marketplace access for the real Claude Code listing, the attacker swapped in a poisoned build15.
Dean Hardcastle tracks malicious packages for the security group OpenSourceMalware. He caught the file live and flagged it the same day6. Jenn Gile, the group's co-founder, then read the code line by line.
"The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code," Gile said5.
An SSH backdoor gives an outside party a quiet way back into a machine later. It skips the password prompt and the login alert a normal connection would trip. The planted key carried a label built to look routine: "svc-telemetry"1.
Inside the 66 Lines
The hidden code ran the moment the editor loaded the extension, ahead of anything a developer typed5. It collected the machine's hostname, username, and git email, then sent that data to a single server, 134.209.82.2256.
It also tried to turn on the machine's SSH service and open a tunnel back to that same address1. Phorion, the security firm that studied the payload, found a coding error in that step. The error blocked the tunnel on most Windows and macOS machines lacking administrator rights.
The loader built its persistence through ordinary operating-system tools: a LaunchAgent on macOS, a scheduled task on Windows1. Either one would relaunch the tunnel attempt roughly every 60 seconds, long after a developer closed the editor for the night.
Calum Hall, Phorion's chief executive, still called the attempt serious. "The goal of this payload is long-term interactive access, and whilst the SSH backdoor bug minimises impact on macOS, the malware is still a significant threat," he said4. A machine that already had Remote Login turned on, Hall added, stayed exposed regardless of the coding error.
Cursor's Containment, in Cursor's Words
Cursor moved fast once it found the file. "We followed with a full shut down of the marketplace out of an abundance of caution," the company wrote in its notice, adding that it "rotated our keys, rebuilt the marketplace, and brought it back online"1. The company also audited every other listing and reported a clean result.
Word of the breach spread fast too. Cursor posted about it on X on Oct. 30, directing developers to its remediation steps2. A Hacker News thread about the same breach drew a long run of comments through Oct. 31. Many of them pressed the same question Sharma later answered on the record7.
66 lines of hidden code reached up to 5,000 developers
Size of the malicious loader against Cursor's own count of developers exposed, Oct. 29, 2026
The first column counts the lines of code the attacker added; the second counts the developers Cursor says the tampered build reached.
The two columns measure different things, code size and headcount, to show how little the attacker had to change to reach that many machines.
Sources: Cursor (@cursor_ai) on X [2]; The Hacker News [5]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Lines of bad code | 66 |
| Developers exposed | 5,000 |
Anthropic drew its own line around the damage. Felix Rieseberg, a member of Anthropic's technical staff, framed where the fault sat. "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected, and this only impacts Cursor users," he said3.
David Dworken, a security engineer at Anthropic, drew the same boundary in his own post on X: the trojanized build "was never published on OpenVSX, the VS Code marketplace, or any of our official hosts" and "this only impacts Cursor users"5.
Cursor@cursor_aiWe identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions…
The Case Rieseberg's Answer Left Open
Ax Sharma is head of research at the security firm Manifold Security. He read the same facts and reached past the question of which company's channel carried the file. The breach, in his reading, skipped the usual step of spotting an impostor.
"This was the official Claude Code extension in Cursor's own marketplace, and one poisoned listing pushed an SSH backdoor to up to 5,000 users," Sharma said. "Checking the publisher name doesn't help when the publisher is real. What helps is watching behaviour: a coding extension planting SSH keys should be caught in seconds"4.
Sharma's point lands past Cursor specifically. Developers increasingly install updates through agents and automatic settings, rarely a person reading a changelog4. A real name on a listing offers thin proof once an attacker controls the account behind it. Checking a name misses exactly that kind of control.
What to Do
Turn off automatic updates for any coding extension that reaches your machine, your SSH keys, or your client's code. Approve each update by hand for a week.
Search your authorized_keys file for a line containing "svc-telemetry," the exact indicator Cursor published for this breach1. Rotate any credential that sat on a machine running Cursor between 2:27 a.m. and 1:35 p.m. PT on Oct. 29.
By the Numbers
- 5,000 developers: the most Cursor says received the tampered Claude Code build before it pulled the listing2.
- 11 hours: how long the fake update stayed live, from 2:27 a.m. to 1:35 p.m. PT on Oct. 291.
- 66 lines: the size of the hidden loader slipped ahead of the real extension's code5.
- 2 versions: 2.1.312 and 2.1.313, the tampered builds Cursor pulled from its marketplace1.
- 60 seconds: how often the persistence script tried to relaunch the tunnel1.
- 134.209.82.225: the single server address the backdoor reported back to6.
What to Watch
Watch for one fix Sharma's point gestures toward: a rule tying a marketplace listing to one verified signing key4. Anthropic's next Claude Code release, judged across every channel Cursor's marketplace touches, offers one early read on that question1. A second trojanized build inside a year would answer the rest before anyone has to ask it twice.
Sources
- Cursor, "Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace," Oct. 29, 2026, https://cursor.com/blog/claude-code-extension-security-notice
- Cursor (@cursor_ai), post on X, Oct. 30, 2026, https://x.com/cursor_ai/status/2116074289053175808
- The Register, "Anthropic: That Claude Code extension compromise… couldn't be us," Oct. 30, 2026, https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682
- Sinisa Markovic, "Claude Code extension poisoned with persistent SSH backdoor," Help Net Security, Oct. 30, 2026, https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/
- The Hacker News, "Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor," Oct. 30, 2026, https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
- OpenSourceMalware, "Trojanized Claude Code Extension Plants an SSH Backdoor," Oct. 30, 2026, https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor
- Hacker News, comment thread on the Claude Code extension breach, Oct. 31, 2026, https://news.ycombinator.com/item?id=50300683
