A tampered Claude Code extension sat in Cursor's marketplace for 11 hours, and up to 5,000 developers installed it

What happened in the Cursor marketplace

Someone shipped modified builds of the official Claude Code extension through Cursor's marketplace, and they stayed live for about eleven hours. Cursor's incident notice is direct about attribution: these versions were not developed by Anthropic, and no other extension or the official distribution is affected.

Once detected, Cursor removed the malicious versions, shut the entire marketplace down out of caution, audited access and confirmed nothing else was tampered with, rotated its keys, rebuilt the marketplace and brought it back online. It also worked with the hosting provider to take the attacker's server offline, which broke the reverse shell and the data drop.

What the malicious extension actually ran

The payload did four things, and the order matters:

• Collected host and user details: hostname, username, OS, architecture, home directory path, working directories, configured Git email, public IP, and the names of environment variables, hunting for anything called key, token, secret or password.
• Appended an attacker-controlled SSH key, labeled svc-telemetry, to the user's authorized_keys file.
• Installed persistence so the backdoor survives a reboot: a LaunchAgent on macOS, and on Windows a scheduled task that tries to run as SYSTEM with a startup-script fallback.
• Opened a reverse SSH tunnel to the attacker's server, retrying roughly every 60 seconds.

Why most installs dodged the worst of it

Two pieces of luck, not any control, kept this from becoming a mass compromise. The step that enables the local SSH service needs administrator rights the extension did not have on most machines, so on a typical install the attacker could not actually log in through the tunnel. And the malicious code had its own bugs that broke that step further.

Luck has limits. Even on those machines, the attacker's key still landed in authorized_keys, the persistence scripts still got planted, and the host details still went out. That is why Cursor tells anyone affected to follow the remediation steps regardless.

How to check and clean an affected machine

If you installed or updated anthropic.claude-code to 2.1.312 or 2.1.313 from the Cursor marketplace on macOS or Windows during that eleven-hour window on October 29:

1. 1Check for the key. Search your SSH authorized_keys file for the string svc-telemetry. On Windows, also check the administrators_authorized_keys file under ProgramData. Cursor's notice has a one-line grep for macOS and a PowerShell snippet for Windows.
2. 2If the string is there, isolate the machine and hunt the indicators Cursor published: the attacker IP, the beacon endpoint, the SSH key fingerprints.
3. 3Remove the unauthorized key, the persistence mechanisms and any running tunnel processes. Do not stop at uninstalling the extension: the payload drops standalone scripts that keep running after the extension is gone. Cursor publishes remediation scripts for both platforms.
4. 4Rotate every credential and session reachable from the affected machine, from a trusted system. The extension only read environment variable names, but the backdoor it tried to open would have exposed far more.

What this means for teams running AI coding tools

The uncomfortable part is how thin the defenses were. An eleven-hour exposure window is a measurement of marketplace review capacity: a marketplace that cannot read a diff before it ships is trusting, not vetting. Extension updates arrive with the same trust as the original install, and AI coding tools now sit on the keys to everything a developer machine holds, which is exactly the secret sweep this payload attempted.

The practical response is boring and worth doing: treat editor extensions like dependencies, pin and review them the same way, watch for unexpected publisher or version changes, and know which machines in your team have SSH enabled at all. On the defensive side of the same story, my Gemini 4 Carbon note covers Google's new model built for exactly this kind of vulnerability and patching work.

FAQ

Sources

1. 01Incident notice and indicators: Cursor security notice (opens in a new tab)
2. 02Install count: Cursor says around 5,000 people may have installed a malicious Claude Code extension - The Verge (opens in a new tab)
3. 03Payload analysis: Inside a malicious Claude Code-branded extension - Microsoft Security Blog (opens in a new tab)

Elsewhere on this site

The selected work catalogue lists the SaaS products and AI builds behind notes like this one.