Malicious Claude Code Extension Hits 5,000 Cursor Users, Installs SSH Backdoor

A malicious version of Anthropic’s Claude Code extension was distributed through the Cursor extension marketplace, potentially exposing up to 5,000 users to a cybersecurity attack. Cursor confirmed that the compromised package, identified as version 2.1.313, contained code designed to collect information about developers’ computers and install a persistent SSH backdoor that could enable unauthorised remote access.

The incident was discovered on October 29, 2026, after the modified extension became available through Cursor’s marketplace for approximately 11 hours. Cursor temporarily shut down its extension marketplace, worked with hosting providers to disable the attacker’s infrastructure and restored the service after completing security checks. The company also clarified that the malicious extension was not developed by Anthropic and advised affected users to update to version 2.1.314.

Key Takeaways

• A malicious Claude Code extension reached Cursor’s marketplace on October 29, 2026.
• The compromised package was identified as version 2.1.313.
• Up to 5,000 users may have been affected, according to Cursor.
• The malware attempted to collect system information and install an SSH backdoor.
• The attack targeted Windows and macOS systems, with researchers also identifying code intended to support Linux environments.
• Cursor temporarily shut down its extension marketplace and later restored it.
• Users who installed the compromised version should investigate their systems rather than simply uninstalling the extension.
• Cursor recommends updating to Claude Code for VS Code version 2.1.314.

What Happened to the Claude Code Extension?

Cursor discovered that a modified version of Anthropic’s Claude Code extension had entered its VS Code extension marketplace.

The package used the identifier Anthropic.claude-code, making it appear to be the legitimate extension developed by Anthropic.

However, the malicious version contained unauthorised code that attempted to compromise computers on which it was installed.

According to Cursor’s security notice, the compromised package was available between approximately 2:27 a.m. and 1:35 p.m. Pacific Time on October 29.

That created an exposure window of roughly 11 hours.

Cursor estimated that up to 5,000 users could have been affected, although it did not disclose the exact number of installations that actually executed the malicious code.

The company also said that the incident did not affect other extensions downloaded from its marketplace.

How the Malicious Extension Worked

The attack involved modifying a legitimate software extension and distributing it through a trusted marketplace.

Once the compromised extension loaded, its malicious code attempted to collect information about the computer and establish a mechanism for persistent remote access.

Researchers identified several activities:

• Collecting the computer’s hostname and username.
• Identifying the operating system and system architecture.
• Gathering information about working directories and the user’s home directory.
• Collecting environment variable names and configured Git email information.
• Recording the computer’s public IP address.
• Attempting to add an attacker-controlled SSH key.
• Attempting to establish a reverse SSH connection.

The malware also included mechanisms intended to keep its processes running after a computer restarted.

This is particularly concerning for developers because their computers often contain source code, project files, access credentials and connections to remote development servers.

What Is an SSH Backdoor?

SSH stands for Secure Shell. It is a widely used technology that allows developers and system administrators to access computers remotely through encrypted connections.

Developers frequently use SSH to connect to cloud servers, manage applications and transfer files.

An SSH backdoor abuses this legitimate technology to provide unauthorised access.

In this incident, the malicious extension attempted to add an attacker-controlled public key to the computer’s authorised SSH keys.

If successful, this could allow the attacker to authenticate remotely without knowing the user’s normal password.

The malware also attempted to enable the local SSH service and establish a reverse tunnel to an attacker-controlled server.

Cursor’s investigation found an important limitation: on most macOS and Windows computers, enabling the SSH service required administrator privileges that the extension did not have.

Consequently, that part of the attack would generally fail on those systems. However, the malware could still add its SSH key, establish persistence mechanisms and transmit collected system information.

Cursor also confirmed that the attacker’s server had been taken offline, disrupting the malicious connections.

Which Users Were Affected?

The incident affected users who obtained the compromised extension through Cursor’s marketplace during the exposure window.

Security detail	Information
Malicious extension	Claude Code for VS Code
Extension identifier	Anthropic.claude-code
Compromised version	2.1.313
Recommended version	2.1.314
Discovery date	October 29, 2026
Exposure period	Approximately 11 hours
Maximum potentially affected users	5,000
Main threat	Persistent SSH backdoor
Marketplace status	Temporarily shut down, then restored

The 5,000 figure represents Cursor’s maximum estimated impact, not a confirmed number of successfully compromised computers.

The company said it would contact affected users directly.

Why Cursor Shut Down Its Extension Marketplace

After discovering the malicious package, Cursor temporarily disabled its extension marketplace to prevent further distribution.

The company also worked with relevant providers to disable the infrastructure hosting the malicious software.

Before restoring the marketplace, Cursor said it:

1. Removed the compromised extension.
2. Blocked further distribution of the malicious package.
3. Worked with the hosting provider to take the attacker’s server offline.
4. Rotated security keys.
5. Audited the marketplace for other compromised extensions.
6. Rebuilt the marketplace before restoring access.

Cursor said its investigation did not identify other tampered extensions.

The company also stated that the incident did not affect Grok, Grok Bot or its other SpaceXSI products.

What Should Affected Cursor Users Do?

Cursor has recommended that users who installed or updated to version 2.1.313 during the exposure window investigate their computers.

Simply uninstalling the extension may not be sufficient because the malicious code attempted to install separate persistence mechanisms.

Users should follow Cursor’s official remediation instructions.

Important precautions include:

• Check whether the unauthorised svc-telemetry SSH key was added to the computer.
• Review SSH configuration and scheduled processes for suspicious changes.
• Investigate unusual network connections and extension activity.
• Remove malicious files and persistence mechanisms using Cursor’s official remediation scripts.
• Rotate credentials and active sessions that could have been accessed from an affected computer.
• Consider rebuilding the system if evidence of compromise is found.

Developers should perform credential rotation from a trusted, unaffected device.

Cursor has published platform-specific detection and remediation instructions in its security notice.

Why AI Coding Extensions Are Becoming Security Targets

AI coding assistants have become deeply integrated into software development workflows.

Tools such as Claude Code, Cursor and GitHub Copilot can interact with source code, development environments and terminal commands.

This makes their extensions particularly attractive targets for attackers.

A compromised browser extension might collect browsing information, but a compromised development extension can potentially gain access to much more sensitive resources.

These may include:

• Private source-code repositories.
• Cloud infrastructure credentials.
• SSH keys and server connections.
• API keys and development tokens.
• Internal project files.
• Environment configuration.

The incident also demonstrates the risks associated with software supply-chain attacks, in which attackers compromise a trusted distribution channel rather than directly targeting every individual victim.

The Bigger Picture

The Cursor incident highlights a growing security challenge as AI tools become part of everyday software development.

Developers increasingly install extensions that can access project files, interact with terminals and connect to external services. These capabilities make AI coding tools useful, but they also increase the potential damage when an extension is compromised.

The attack also raises questions about how marketplaces verify extension publishers and monitor updates. A package carrying a familiar company name is not necessarily an authentic release from that company.

For technology companies, stronger publisher verification, package signing, automated malware detection and rapid incident response will become increasingly important.

Looking Ahead

Cursor has restored its marketplace and says it has neutralised the malicious infrastructure associated with this incident. The next important step is identifying which installations actually executed the payload and ensuring affected users have removed any remaining backdoor mechanisms. The company’s decision to contact affected users directly should also help determine the incident’s real-world impact.

For developers, the incident is a reminder that AI coding extensions should be treated like any other software with access to sensitive systems. Checking publishers, verifying versions, limiting permissions and investigating unexpected behaviour can reduce exposure. As AI development tools gain deeper access to computers and cloud infrastructure, securing their software supply chains will become increasingly important.

Frequently Asked Questions

1. What happened to the Claude Code extension on Cursor?

A maliciously modified version of Anthropic’s Claude Code extension was distributed through Cursor’s marketplace on October 29, 2026. It attempted to collect computer information and install an SSH backdoor.

2. How many Cursor users were affected?

Cursor said up to 5,000 users may have been affected. The company did not confirm how many installations actually executed the malicious code.

3. Was the malicious extension created by Anthropic?

No. Cursor explicitly stated that the compromised version was not developed by Anthropic. It impersonated the legitimate Claude Code extension.

4. Which Claude Code version was compromised?

The affected version was 2.1.313. Cursor advised users to update to version 2.1.314.

5. What information could the malware collect?

The malicious code attempted to collect usernames, hostnames, operating system details, public IP addresses, working directories and other system information.

6. Could hackers remotely control affected computers?

The malware attempted to establish remote access through an SSH backdoor. However, Cursor found that enabling the SSH service generally required administrator privileges that the extension did not have on most Windows and macOS systems.

7. Is uninstalling the extension enough?

Not necessarily. The malicious code attempted to install separate persistence mechanisms. Affected users should follow Cursor’s official remediation instructions and investigate their systems.

8. Is Cursor’s extension marketplace available again?

Yes. Cursor temporarily shut it down after discovering the incident, worked with relevant providers to neutralise the malware and subsequently restored the marketplace.