Tampered Claude Code Extension on Cursor Marketplace Opened SSH Backdoor for Attackers

Cursor said Anthropic did not build the malicious version. Anthropic said in a statement reported by BankInfoSecurity that "a malicious actor used access to Cursor's marketplace to publish a tampered extension." Microsoft published a technical analysis on October 30. It said Anthropic had told it that Anthropic's own systems were not compromised, and that the evidence points to an incident limited to the Cursor marketplace. According to Microsoft, the tampered packages never appeared on the Visual Studio Marketplace or in Anthropic's npm package.

Cursor has not said how the attacker got access to its marketplace or who was behind the attack. BankInfoSecurity describes Cursor as owned by SpaceXAI, a SpaceX subsidiary.

How the Backdoor Worked

Microsoft said the poisoned extension was live for about 11 hours on October 29, from roughly 2:27 a.m. to 1:35 p.m. Pacific time. The reports differ on which versions were affected: Microsoft lists 2.1.312 and 2.1.313, while BankInfoSecurity names only 2.1.313.

Researcher Paul McCarty found that the tampered package matched the genuine one except for its main JavaScript file, BankInfoSecurity reported. That file contained a 66-line loader that ran as soon as the extension started, so users did not have to interact with Claude for it to execute.

The loader did the following:

It added an SSH key controlled by the attacker.

It tried to switch on the machine's SSH service.

It opened a reverse SSH tunnel to an outside server.

It set itself up to keep running after a restart.

It sent details about the computer over unencrypted HTTP.

Those details included the hostname, username, operating system, Git email address, and the names of up to 40 environment variables whose names suggested keys, tokens or secrets. Microsoft said only the names were sent, not the values.

Microsoft said the code suppressed its own errors so the extension kept working normally, and that it "may still write keys and persistence artifacts even when tunnel access fails." Cursor said switching on SSH would probably fail without administrator rights, but the key, the persistence and the data transmission could still succeed. BankInfoSecurity said Phorion, a macOS endpoint security vendor, appears to have been the first to flag the extension publicly.

Clean-Up Falls to Users

Cursor took its marketplace offline, checked its other extensions and found no further tampering, then restored the marketplace later the same day. It said it had worked with its cloud provider to take the attacker's server offline, so the tunnel and the data beacon no longer work. It also said it will contact every user who downloaded the affected version. Anthropic released version 2.1.314 without the malicious code.

Researchers say updating is not enough. Security researcher Kevin Beaumont pointed out that the automatic update does not remove a backdoor that is already installed, writing that "you need to manually remediate every impacted VS Code and Cursor system."

Microsoft gives organisations these steps:

Find machines that installed the affected versions, and preserve evidence before cleaning up.

Remove the attacker's SSH key, labelled "svc-telemetry", and any persistence entries.

Rotate credentials and revoke sessions where exposure is suspected.

Limit extensions to approved publishers, and set a waiting period before new versions install.

Why It Matters

AI coding agents usually run with wide access to source code, credentials and developer machines, which makes the channels that distribute them attractive to attackers. In this case the attacker used a trusted product name to reach users through a third-party marketplace, not the vendor's own channels. Companies rolling out agentic coding tools to large engineering teams have to check where every extension comes from, not only who makes the underlying model.