Cursor VS Code Extension at a glance
For about 11 hours on October 29, 2026, Cursor's extension marketplace served tampered Anthropic.claude-code 2.1.312 and 2.1.313 builds for macOS and Windows. Cursor says at most 5,000 users installed them. Official VS Code and Open VSX builds were not affected.
Cursor VS Code Extension: status
- Affected
- Anthropic.claude-code 2.1.312 and 2.1.313 for macOS and Windows installed or updated from the Cursor VS Code Extension Marketplace between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026
- Not affected: builds from the Microsoft VS Code Marketplace, Open VSX or Anthropic's other official channels, and other extensions in Cursor's marketplace, per Cursor and Anthropic
- CVE identifiers
- Not published
- Status as of
- Discovered by
- Cursor's own detection, with public disclosure credited to researchers at OpenSourceMalware and Phorion
What changed with Cursor VS Code Extension
On October 29, 2026, Cursor disclosed that malicious builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313 for macOS and Windows, were available in the Cursor VS Code Extension Marketplace from about 2:27 a.m. to 1:35 p.m. PT. Cursor removed them, shut down the marketplace to audit other extensions and rotate its keys, then brought a rebuilt marketplace back online. Cursor told reporters at most 5,000 users were affected; researchers at OpenSourceMalware and Phorion were credited with early disclosure.
StepSecurity found a short JavaScript loader added to the start of the extension's code. It ran as soon as the extension loaded, with no user action. It collected host details and the names, not values, of credential-like environment variables, added an attacker SSH key labeled svc-telemetry, tried to enable SSH and open a reverse tunnel every 60 seconds, and installed persistence as a macOS LaunchAgent or a Windows scheduled task. Cursor says the SSH steps often fail without admin rights.
Anthropic said its own systems were not compromised and that the VS Code Marketplace and Open VSX builds were clean. How the attacker gained publishing access to Cursor's marketplace has not been explained. The attacker's server has been taken offline.
How to fix it: Cursor VS Code Extension
1. Monitor
Search for the svc-telemetry key in ~/.ssh/authorized_keys on macOS, and in %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys on Windows. Also check for the com.apple.sysmond LaunchAgent or a SysMon scheduled task.
cursor.com (opens in a new tab)2. Workaround
If indicators are present, isolate the host, run Cursor's remediate-macos.sh as the affected user or remediate-windows.ps1 in an elevated PowerShell, and consider rebuilding the machine; uninstalling the extension alone may not remove persistence.
cursor.com (opens in a new tab)3. Update
From a trusted machine, rotate credentials, tokens and sessions that the affected host could reach, then reinstall the extension from a clean, current version.
cursor.com (opens in a new tab)4. Monitor
Search endpoint and network logs for connections to 134.209.82.225 on ports 22 and 8099 and for ssh -N -R or autossh tunnel processes.
stepsecurity.io (opens in a new tab)
Advisories
Why Cursor VS Code Extension matters for businesses
For agencies, check every Cursor install on Macs and Windows PCs that updated extensions on October 29. If the svc-telemetry key is present, treat the machine as compromised: isolate it, run Cursor's cleanup script, consider rebuilding it, and rotate every credential and session it could reach.
Sources for this story
- Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace (opens in a new tab)Official
Cursor · cursor.com
- Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines (opens in a new tab)Press
StepSecurity · stepsecurity.io
- Malicious Claude Code extension on Cursor planted SSH backdoors (opens in a new tab)Press
BleepingComputer · bleepingcomputer.com
- Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor (opens in a new tab)Press
The Hacker News · thehackernews.com
Last verified: . IA Compa summarizes public announcements for business readers. We are not affiliated with the companies mentioned. Always confirm details, pricing, and availability with the official source.
- #security
- #cursor
- #supply-chain
- #malware
- #ide-extensions
- #coding-agents