Cursor's own notice says the truth plainly. A trojanized Claude Code update sat in its marketplace for eleven hours, long enough to reach up to 5,000 developers12.
Five days later, the notice says the same four things. Cursor pulled the build, audited every other listing, rotated its keys and rebuilt the marketplace1. It skips the one fact every developer still wants: how the attacker reached Cursor's publishing system in the first place.
Any company running Cursor should check today whether its fleet turns on the install delay Cursor's own documentation now describes8.
Eleven Hours, Then Silence
An SSH connection lets a developer reach a distant computer and run commands on it. A backdoor hands that same reach to a stranger instead, quietly and on command3.
The tampered build carried the real anthropic.claude-code name, versions 2.1.312 and 2.1.3131. Cursor's marketplace served it from 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 292. Its server listened on two ports, 22 for the tunnel home and 8099 for a one-time check-in3.
Calum Hall runs Phorion, the security firm that first studied the payload. "The goal of this payload is long-term interactive access, and whilst the SSH backdoor bug minimises impact on macOS, the malware is still a significant threat," Hall said5.
Felix Rieseberg, a member of Anthropic's technical staff, drew his own line around the breach. "We're working with Cursor on this incident, but it wasn't a compromise of Anthropic's systems or employee laptops," he said4. That line matters. The tampered file reached only Cursor's marketplace copy, while Anthropic's own release channels stayed clean1.
The code reached three systems in three different ways. It tried a LaunchAgent on macOS, a scheduled task on Windows, and on Linux a cron job set to fire at every reboot7. Each one gave the backdoor a way to return after a developer closed the editor for the night.
What Cursor's Notice Skips
Cursor's notice carries a timestamp: 11:30 a.m. Pacific time, Oct. 301. Reading it again on Nov. 3 turns up the same four steps, word for word.
That notice names what Cursor did. It stops short of saying how a stranger reached the account that controls its marketplace1.
Cursor's Security Notice Sat Unchanged for 5 Days
Dates in Cursor's public response to the Claude Code extension breach, Oct. 29 to Nov. 3, 2026
Each pin marks a step in Cursor's response; the gap after Oct. 30 is how long the notice has gone since its last edit.
Sources: Cursor [1]; BleepingComputer [2]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| Oct. 29, 2026 | Tampered build goes live. 2:27 a.m. to 1:35 p.m. Pacific time, an 11-hour window |
| Oct. 30, 2026 | Notice last updated. Cursor's security notice, last edited 11:30 a.m. Pacific time |
| Nov. 3, 2026 | Cause still owed, day 5. Cursor's notice still matches its Oct. 30 text, five days later |
Phorion's own write-up goes further than Cursor's notice does. It traces the malware line by line. One flawed check inside it saved many Windows and Mac machines from a working tunnel3. The write-up skips how the attacker first got a login to Cursor's publishing system, the access every later step depended on.
Two Views From the Record
Security researchers read five quiet days two different ways.
Yash Kadakia founded the security firm Security Brigade and serves as its chief technology officer. "When malicious code can reach developers through what appears to be a legitimate, routine update, the traditional assumption that software from a trusted marketplace is safe starts to break down," Kadakia told CSO Online6. His point reaches past this one marketplace. A familiar name on a listing proves less once someone else controls the account behind it.
Cursor's own account reads differently. "We worked with the hosting provider to take the malicious server offline, disrupting the attack by blocking the connection to that server," the company wrote, beside the key rotation and the marketplace rebuild in the same notice1. Read plainly, that is a company that moved fast and said so. The account answers what Cursor did, yet leaves open how the publishing account first slipped away.
Steve Povolny studies AI security at Exabeam. "Removing the extension only sends the visitor away while the spare key stays on the hook," he said, pointing at the SSH key the malware planted on every machine it reached6.
A Marketplace Is Now a Supply Chain
Kadakia's firm studies supply chains for a living. "An extension marketplace is effectively another software supply chain," he said6. He then named four fixes. Stronger publisher checks, controlled rollouts, signed packages, and monitoring that watches what an update does, past the name on its listing, topped his list.
Cursor's own enterprise documentation already lists one of those fixes. Teams can delay an extension's install until the update has stayed public for a set number of hours8. The same control can also require a signed package, already live in Cursor's documentation. Cursor leaves the default setting, on or off, unconfirmed for every customer.
Eleven hours fits inside half of a 24-hour day. Cursor's silence has already run ten times longer than that1.
Cursor Has Stayed Quiet 10 Times Longer Than the Breach Lasted
Length of the Oct. 29 exposure window against the days since Cursor's notice was last edited, in days
The first column is how long the tampered build stayed live; the second is how long Cursor's notice has gone since its last edit, as of Nov. 3.
Source: Cursor [1]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value | Note |
|---|---|---|
| Breach window | 0.5 days | 11 hours, Oct. 29 |
| Silence since | 5.0 days | Oct. 30 to Nov. 3 |
What to Do
Ask your engineering lead one direct question this week. Does your Cursor fleet turn on the install delay and the signature check Cursor's own documentation describes8?
Search any machine that ran Cursor between 2:27 a.m. and 1:35 p.m. Pacific time on Oct. 29 for an SSH key labeled svc-telemetry, the exact marker Cursor published1. Rotate any credential that sat on that machine.
By the Numbers
- Up to 5,000 developers: the most Cursor says could have downloaded the tampered build before it pulled the listing12.
- Eleven hours: how long the fake update stayed live, from 2:27 a.m. to 1:35 p.m. Pacific time on Oct. 292.
- Two versions, 2.1.312 and 2.1.313, were the builds Cursor removed from its marketplace1.
- Three operating systems, macOS, Windows and Linux, each got their own way to survive a reboot17.
- Two ports, 22 and 8099, carried the backdoor's tunnel and its check-in3.
- Nearly 3.7 million bytes made up the tampered extension.js file Phorion recovered7.
- Five days have passed since Cursor's notice last changed, as of Nov. 31.
What to Watch
Watch Cursor's own public notice for a new timestamp. Closing the gap Kadakia named takes a real account of how the attacker reached the publishing system in the first place16. A second trojanized listing inside a year would answer the rest before anyone has to ask twice. Posting the cause before then would answer it sooner.
Sources
- Cursor, "Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace," Oct. 30, 2026, https://cursor.com/blog/claude-code-extension-security-notice
- Bill Toulas, "Malicious Claude Code extension on Cursor planted SSH backdoors," BleepingComputer, Oct. 30, 2026, https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/
- Calum Hall, "Official Claude Code Extension Compromise: Security Advisory," Phorion, Oct. 31, 2026, https://phorion.io/blog/offical-claude-code-vsx-compromise/
- Connor Jones, "Anthropic: That Claude Code extension compromise… couldn't be us," The Register, Oct. 30, 2026, https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682
- Sinisa Markovic, "Claude Code extension poisoned with persistent SSH backdoor," Help Net Security, Oct. 30, 2026, https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/
- Gyana Swain, "Cursor removes malicious Claude Code extension after SSH backdoor attempt," CSO Online, Nov. 2, 2026, https://www.csoonline.com/article/4243210/cursor-removes-malicious-claude-code-extension-after-ssh-backdoor-attempt.html
- Rohan Prabhu, "Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines," StepSecurity, Oct. 30, 2026, https://www.stepsecurity.io/blog/claude-code-extension-trojanized
- Cursor, "Security and Privacy Hardening," Nov. 3, 2026, https://cursor.com/docs/enterprise/security-hardening
