Cursor pulls a malicious Claude Code extension from its marketplace

Cursor identified and removed a maliciously modified version of Anthropic's Claude Code extension, labeled version 2.1.313, from its VS Code extension marketplace. Cursor says the tampered package was not made by Anthropic and that at most 5,000 users were affected; it plans to reach out to them directly. The incident window ran from about 2:27am to 1:35pm PT on October 29, 2026.

The malicious version collected host and user information and attempted to install a persistent SSH backdoor by adding an attacker-controlled key to authorized_keys, enabling the local SSH service, and opening a reverse SSH tunnel, with persistence set up via a macOS LaunchAgent or a Windows scheduled task. It reported status back to an attacker server, which Cursor says it worked with the hosting provider to take offline, and the company found no evidence that other extensions were tampered with.

Cursor shut down and rebuilt its entire marketplace as a precaution and rotated its keys. For affected users, Cursor recommends checking for the attacker's 'svc-telemetry' SSH key, isolating any impacted host, running its published remediation scripts (noting that simply uninstalling the extension isn't enough, since the payload drops separate persistence scripts), and rotating credentials from a trusted system.

Why it matters

It's a reminder that even official-looking extensions in trusted marketplaces can be tampered with, so verifying packages and watching for backdoor indicators matters for anyone using AI coding tools.

Source: Cursor