Cursor says a malicious Claude Code VS Code extension was distributed through its extension marketplace, according to its X post. The build, version 2.1.313 of Anthropic.claude-code, was modified, and Cursor says Anthropic did not develop it. It was available from about 2:27am to 1:35pm PT on October 29, 2026, and Cursor says at most 5,000 users were affected.

Cursor says it will contact affected users directly and has asked all customers to update Claude Code for VS Code to version 2.1.314.

What the package did

Cursor's security notice says the modified build tries to:

  • collect host details, including hostname, username, OS, architecture, home directory path, environment variable names, working directories, the configured Git email and public IP

  • add an attacker-controlled SSH key, enable the local SSH service and open a reverse SSH tunnel

  • persist through a macOS LaunchAgent, or on Windows a scheduled task meant to run as SYSTEM with a Startup-folder fallback, retrying the tunnel roughly every 60 seconds

  • send host details to a server on port 8099

Cursor says the attacker server no longer works, because it worked with the hosting provider to take it offline. It also says the step that enables SSH needs admin rights that the extension does not have on most macOS and Windows hosts. Even there, Cursor says the key, persistence and host reporting steps can still run, so it advises following the remediation steps regardless.

How to check and clean up

Cursor's check looks for an unauthorized public key with the comment svc-telemetry in SSH authorized_keys files. It provides a grep command for macOS and a PowerShell search for Windows. Cursor says uninstalling the extension may not be enough, because the payload drops standalone persistence scripts that keep running.

For machines where the key is found, Cursor advises:

  • isolating hosts that show payload execution or backdoor installation

  • running its remediation script for the platform to remove the extension, persistence mechanisms, tunnel processes and the attacker's key

  • deciding whether the host should be rebuilt

  • rotating credentials and sessions accessible from the host, using a trusted system

Cursor says the limited environment-variable collection does not rule out later credential access over the backdoor.

Indicators Cursor lists include:

  • SHA-256 of the modified darwin-arm64 VSIX: 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62

  • SHA-256 of the modified win32-x64 VSIX: 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081

  • Attacker endpoint: 134[.]209[.]82[.]225, reached over reverse SSH on TCP 22 and HTTP on port 8099

  • Key comment: svc-telemetry

Marketplace status

Cursor says it removed the malicious version and blocked further distribution on detection, then shut down the whole marketplace as a precaution. It says it audited access, rotated its keys, rebuilt the marketplace and brought it back online, and found no other extensions tampered with. Cursor says the findings concern only the identified package and that it has no evidence other versions or the official distribution are affected.

In its X post, Cursor says the incident does not affect other extensions downloaded from its marketplace, Grok Bot, Grok or its other products.

Our read: the update to 2.1.314 matters most for teams that install extensions from the Cursor marketplace, since the modified build was available for about 11 hours before it was removed.

Sources