A malicious Claude Code extension planted an SSH backdoor—updating alone is not enough
Cursor says malicious versions 2.1.312 and 2.1.313 were served to macOS and Windows users for about 11 hours. The server is offline and distribution has stopped, but affected machines may retain an unauthorized SSH key and persistence files that must be removed.
The short version
- What happened
- Cursor says malicious macOS and Windows builds of Anthropic.claude-code versions 2.1.312 and 2.1.313 were available in its extension marketplace from about 2:27am to 1:35pm Pacific Time on 29 October.
- Who it affects
- Developers may keep source code, cloud credentials and signing access on the same computer as their editor. A hidden SSH authorization entry can therefore put personal work, employer systems and software customers at risk even after the visible extension has been updated.
- What remains unproven
- The verified exposure concerns malicious macOS and Windows builds served through Cursor's marketplace. Microsoft says official Anthropic distribution, Microsoft's Visual Studio Marketplace and npm were not affected.
Keep in mind
The verified exposure concerns malicious macOS and Windows builds served through Cursor's marketplace. Microsoft says official Anthropic distribution, Microsoft's Visual Studio Marketplace and npm were not affected.
No reviewed primary source gives a final count of installations, successful tunnels, attacker logins or stolen secrets. Environment-variable names were collected; Microsoft says that alone does not demonstrate theft of their values.
The attacker server is offline, but that does not remove local persistence. Readers should use the maintained official notice rather than copying isolated commands from secondary reports.
Multi-source analysis · 2 linked sources. Primary analysed source date: 29 October 2026. Latest linked supporting source: 30 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 4 min The evidence, methods, implications and limitations
The package disappeared, but its changes can remain
Cursor has told users to check macOS and Windows computers that installed or automatically updated Anthropic's Claude Code extension from its marketplace during an approximately 11-hour window on 29 October. The company says versions 2.1.312 and 2.1.313 contained injected JavaScript that collected device and user details, looked for environment-variable names associated with credentials, added an attacker-controlled SSH key and attempted to establish a persistent reverse tunnel. Anthropic did not develop the malicious builds.
Distribution has ended: Cursor removed the packages, shut down and rebuilt its extension marketplace, rotated keys and worked with the hosting provider to disable the attacker server. That reduces immediate command-and-control risk, but it does not clean a machine. The code wrote an SSH authorization entry, scripts and startup configuration outside the extension folder. Cursor therefore warns that updating to a safe release or uninstalling the extension can leave the attempted backdoor and persistence behind.[1][2]
Affected teams need evidence-led cleanup, not a version check
The official response is to identify installations from the Cursor marketplace in the stated window, preserve evidence, isolate machines showing payload execution, remove the unauthorized key and persistence, stop tunnel processes and review endpoint and network telemetry. Credentials and sessions accessible from an affected computer should be rotated from a trusted machine when investigation indicates exposure or device trust cannot be restored. Cursor supplies platform-specific checks, indicators and remediation scripts; Microsoft adds hunting guidance and stresses that cleanup should preserve unrelated SSH configuration.
The incident's denominator remains uncertain. The current notice does not report how many devices installed the malicious builds, how many successfully opened a tunnel or whether an attacker used a tunnel to access a machine. Microsoft says successful remote access depended on privileges, SSH configuration and server settings; code capability is not proof that every step succeeded. The narrow verified claim is still consequential: a trusted marketplace served a tampered AI-coding extension, and potentially affected hosts require action beyond a routine update.[1][2]
The distinction that matters
Who needs to act, and why?
The relevant test is distribution channel, version and time—not whether the extension now looks current.
Exposure
Cursor marketplace on macOS or Windows; versions 2.1.312 or 2.1.313 during the 29 October window
Run Cursor's official checks and inspect installation records
Artifacts
Look for the unauthorized SSH key, scripts, startup entries and tunnel processes
Preserve evidence, isolate and remove confirmed malicious components
Recovery
Review telemetry and assess whether credentials or sessions were exposed
Rotate from a clean device and rebuild when trust cannot be restored
Continue the story
Read next
Continue exploring software supply chain: compare the finding and its evidence limits.
A coding agent can look normal while a backdoored extension steals credentials
CERT-EU modified two legitimate packages in an isolated lab. A routine phrase triggered background data collection outside the model's visible tool calls, showing why plugin controls must cover the whole agent environment.
Read the next reportExplore the full source and evidence record
What this means for people
- Developers may keep source code, cloud credentials and signing access on the same computer as their editor. A hidden SSH authorization entry can therefore put personal work, employer systems and software customers at risk even after the visible extension has been updated.
Global context
Developer extensions execute inside trusted work environments and can inherit broad access to repositories, files and credentials. The incident shows why AI-tool supply-chain controls need publisher verification, allowlists, delayed automatic updates, endpoint monitoring and an inventory of extensions—not only model-level safety checks.
What the evidence does not yet show
- The verified exposure concerns malicious macOS and Windows builds served through Cursor's marketplace. Microsoft says official Anthropic distribution, Microsoft's Visual Studio Marketplace and npm were not affected.
- No reviewed primary source gives a final count of installations, successful tunnels, attacker logins or stolen secrets. Environment-variable names were collected; Microsoft says that alone does not demonstrate theft of their values.
- The attacker server is offline, but that does not remove local persistence. Readers should use the maintained official notice rather than copying isolated commands from secondary reports.
What to watch next
- Cursor's root-cause account
- A final affected-device denominator
- Evidence of successful attacker access
- Anthropic's public incident statement
- Independent forensic findings
- Marketplace signing and publisher-control changes
Living evidence record
Impact record IAI-1TIZ9Z2
Evidence stage
Announced
Confidence
Supported
Reporting basis
Multi-source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
31 October 2026
Source trail
2 direct sources across 2 source types.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Evidence trail
Sources used for this report
Links checked 31 October 2026
Research question, topics and regions
Topics: Software supply chain · Developer security · Cursor · Claude Code · SSH backdoor · Incident response
Regions: North America · United States · Global
This report is labelled multi-source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.