Tampered Claude Code extension in Cursor's marketplace: what it did and what to do now

Cursor published a security notice on 29 October 2026. It updated the notice on 30 October to add the signs of compromise to look for and to clarify which versions were affected.

The notice covers versions 2.1.312 and 2.1.313 of the extension listed as Anthropic.claude-code, for Windows and macOS, in Cursor's VS Code extension marketplace. Cursor says these versions were not developed by Anthropic.

The tampered version was available between about 2:27am and 1:35pm Pacific time on 29 October 2026. By our arithmetic, that is a little over 11 hours. In a post on X, Cursor said the incident affected at most 5,000 users.

Cursor says the code collected and sent out details of each machine and its user. They include the hostname, username, operating system, chip type and home folder path. They also include the working folders, the configured Git email, the public IP address and the names of environment variables. Environment variables are settings that programs read when they start.

The code also added the attacker's SSH key to the machine's list of keys allowed to log in remotely. It then tried to switch on the machine's SSH service and to open a reverse tunnel. That tunnel runs out to the attacker's server and could be used to reach back in, and background scripts retried it about every 60 seconds.

To keep running after a restart, it installed a LaunchAgent on macOS, a program that starts at login. On Windows it set a scheduled task that tried to run under SYSTEM, the account with full control of the machine. A Startup script was the fallback.

Cursor removed the version when it detected it and blocked its distribution. It then shut down the whole marketplace, audited access and confirmed no other extensions had been tampered with. Cursor rotated keys, rebuilt the marketplace and brought it back online. It also worked with the cloud provider hosting the attacker's server to take that server offline.

Cursor says the incident does not affect its other products or the other extensions on its marketplace. It has no evidence that other versions or the official distribution are affected. In its post on X, Cursor asked all customers to update Claude Code for VS Code to version 2.1.314.

An extension runs with the permissions of the editor and of the person using it. Phorion's advisory says a tampered one can reach local files, source code and developer tools as soon as it loads, without the user opening it.

Cursor says switching on the SSH service needs admin rights, which the extension does not have on most macOS and Windows machines. On those machines that step failed, so the attacker could not have logged in through the tunnel. The extension still added the attacker's key, installed its restart scripts and sent the machine details, Cursor says. Cursor tells everyone affected to follow its clean-up steps either way.

A company's first step is to find out whether anyone uses Cursor, and who installed or updated the extension on 29 October. Cursor's check script and the svc-telemetry key label give a starting point on each machine.

Anyone who installed or updated to 2.1.312 or 2.1.313 from Cursor's marketplace during the window should start with Cursor's check script. The tampered extension labels its key svc-telemetry in the machine's list of authorised SSH keys. Cursor gives a one-line check for it on macOS and another on Windows.

Next, Cursor says to search device, network and extension-install logs for the signs of compromise it lists. Isolate any machine that shows the payload ran or the backdoor was installed.

Then remove the unauthorised SSH key, the restart scripts and the tunnel processes, and decide whether to rebuild the machine. Cursor publishes clean-up scripts for both systems. It warns that uninstalling the extension may not be enough, because the payload leaves standalone scripts that keep running.

Last, rotate the credentials and sessions the machine could reach, working from a trusted system. Cursor says the code collected only the names of environment variables, but that doesn't rule out the attacker using the backdoor to reach credentials later.

Phorion's advisory tells organisations to check their systems now for versions 2.1.312 and 2.1.313. Wherever the extension was used, Phorion says to start incident response.

A developer laptop can hold Git tokens, cloud keys and API keys for shared systems as well as the developer's own logins. Each machine needs its own list of what to rotate.

Phorion says the code has no exploit to gain admin rights. On macOS, a bug in its check usually means it skips switching SSH on.

Remote Login is the macOS setting that allows SSH. Phorion says that if the user already had it on, or turns it on later, the backdoor works. A Mac with the key still in place can stay exposed until the key is removed.