Cursor: a backdoored Claude Code extension opened SSH tunnels

01What happened

Cursor published a security notice on October 29, 2026 about malicious builds of the Anthropic.claude-code extension served from the Cursor extension marketplace. Cursor says the builds were available from about 2:27am to 1:35pm Pacific time that day and were not developed by Anthropic. Socket reports that the first analysis came from Paul McCarty at OpenSourceMalware, and that Cursor later confirmed its own marketplace was the distribution channel.

02How it works

The malicious version shipped a modified extension.js inside the darwin-arm64 and win32-x64 folders of the package. On execution it collected host and account details, including hostname, username, operating system, home directory, configured Git email and public IP. The code then tried to append an attacker-controlled SSH key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel to the attacker's host. Cursor says the tunnel step usually failed because it needs administrator rights, but the key and the persistence were still installed.

03Who is affected

Developers who installed or updated the Claude Code extension through the Cursor extension marketplace during the October 29 window are exposed, on macOS and Windows. Cursor's notice now names two affected builds, 2.1.312 and 2.1.313, after listing only 2.1.313 when it was first published. Cursor states it has no evidence that other versions of the extension or Anthropic's official distribution are affected.

04What to do

Check affected machines for the indicators in Cursor's notice, starting with an SSH key commented svc-telemetry in authorized_keys, then run Cursor's remediation script for macOS or Windows. Isolate any host that shows the payload ran, and rotate credentials and sessions reachable from it from a trusted machine. Cursor warns that uninstalling the extension may not be enough and that the host may need to be rebuilt.

Questions people ask

Am I affected if I installed the Claude Code extension from Cursor on October 29?

Cursor says users who installed or updated the Claude Code extension through its marketplace between about 2:27am and 1:35pm Pacific time on October 29, 2026 may have received the tampered 2.1.313 build. Cursor puts the upper bound at 5,000 users and is contacting them directly. Checking for an SSH key commented svc-telemetry in authorized_keys is the fastest confirmation.

Is the official Claude Code extension from Anthropic safe?

Cursor states the malicious 2.1.313 build was not developed by Anthropic and that it has no evidence that other versions of the extension or Anthropic's official distribution are affected. Cursor also audited marketplace access and found no other extension had been tampered with. Socket notes that npm and GitHub releases skip 2.1.313 and that the 2.1.314 changelog does not explain the gap.

Is uninstalling the extension enough to clean an affected machine?

Cursor says uninstalling the Claude Code extension may not be enough, because the payload installs an SSH key and persistence that survive removal. Cursor publishes remediation scripts, remediate-macos.sh to run as the affected user and remediate-windows.ps1 to run as Administrator, and advises isolating hosts that show payload execution. Cursor adds that some machines may need to be rebuilt.

How does the Cursor marketplace incident compare with the LiteLLM package compromise?

Both incidents put attacker code into a trusted distribution channel used by AI developers, but the reach differs. LiteLLM 1.107.0 shipped credential-stealing wheels to PyPI, which PyPI quarantined. The Cursor case involved one extension version served from a single vendor's own marketplace for part of October 29, with Cursor rebuilding the marketplace afterwards and capping exposure at 5,000 users.

Sources 3 links, all fetched

1. 1cursor.comCursor Security Notice
2. 2socket.devSocket Analysis
3. 3phorion.ioPhorion Teardown