Malicious Claude Code Extension on Cursor: What Teams Should Check

What happened

Cursor's security notice, dated October 29, 2026 and updated the next day, says a maliciously modified version of the Claude Code extension was available in the Cursor VS Code Extension Marketplace between about 2:27 a.m. and 1:35 p.m. Pacific Time that day (5:27 a.m. to 4:35 p.m. Eastern). Cursor says those versions were not developed by Anthropic.

Microsoft Security Research published a technical analysis on October 30, 2026. Microsoft says the injected JavaScript runs when the extension module loads and attempts to add an attacker-controlled SSH key, enable the local SSH service, establish reverse SSH forwarding, configure persistence, and report host details. Microsoft is clear that a successful remote login depends on host privileges, SSH configuration, and the attacker's server. The loader may still write keys and persistence files even when the tunnel fails.

Both Cursor and Microsoft report that turning on the local SSH service requires administrator rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts, Cursor says, that step fails and the attacker could not have logged in through the tunnel. Cursor still warns that the extension added the attacker's SSH key, installed persistence, and sent host details, and that teams should follow remediation steps regardless.

Microsoft says the loader collected host information such as hostname, username, operating system, architecture, home directory, working directory, and global Git email. It also looked for environment-variable names containing terms such as KEY, TOKEN, SECRET, PASS, AWS, or GCP, keeping up to forty matches. Microsoft says the callback sent matching names, not the secret values themselves.

Persistence, as Microsoft reconstructed it, was written outside the extension directory. Examples include a macOS LaunchAgent named to resemble a system service, a Linux user crontab @reboot entry, a Windows scheduled task named SysMon that attempted to run as SYSTEM, and a Windows Startup-folder fallback. Cursor published indicators of compromise and platform-specific remediation scripts in its notice.

The Hacker News, citing Anthropic security engineer David Dworken, reported that Anthropic said versions on its official channels, including VS Code and Open VSX, were not affected and that the incident impacted Cursor users. The same report quoted Anthropic engineering manager Felix Rieseberg saying Anthropic was working with Cursor and that the incident did not involve a compromise of Anthropic's systems or employee laptops. Microsoft independently wrote that Anthropic confirmed its systems were not compromised.

Cursor says it removed the malicious version, shut down the marketplace as a precaution, audited access, rotated keys, rebuilt the marketplace, and worked with the hosting provider to take the attacker server offline. Microsoft's analysis still treats leftover keys and startup files on a device as a separate cleanup problem after that takedown.

Who should check

You should treat a workstation as in scope if someone installed or automatically updated anthropic.claude-code version 2.1.312 or 2.1.313 from the Cursor marketplace on October 29, 2026, especially during the window Cursor published. Cursor's notice focuses on Windows and macOS. Microsoft also documented Linux persistence artifacts, so Linux users of the same extension should read Microsoft's write-up rather than assuming they are out of scope.

Microsoft says the Visual Studio Marketplace copies and the npm package @anthropic-ai/claude-code were not affected. Installing Claude Code only from those official channels is not the same situation as installing the tampered Cursor marketplace builds. If you are not sure which marketplace a machine used, check the installed extension version and the install source before you decide the host is clean.

What to do

1. Identify machines that used Cursor that day. Ask developers and anyone else using AI coding tools whether they installed or updated Claude Code from the Cursor marketplace on October 29, 2026. Review extension-installation records if you have them.
2. Use the official checks. Cursor published a simple test: look in the user's SSH authorized_keys file for a key comment labeled svc-telemetry. Microsoft lists additional files and startup objects to inspect. Follow those notices rather than improvising a cleanup.
3. Do not stop at uninstalling the extension. Cursor and Microsoft both say the payload can drop standalone persistence outside the extension folder. Remove confirmed unauthorized SSH keys, scripts, and startup entries after you preserve evidence.
4. Isolate and investigate before you trust the machine again. Microsoft advises preserving the extension package, modified SSH files, generated keys and scripts, and startup configuration; isolating devices with evidence of loader execution; reviewing endpoint and network telemetry; and rotating credentials or revoking sessions from a known-clean device when exposure is indicated. Rebuild the device if the investigation requires it.
5. Tighten how extensions get onto workstations. Microsoft points readers to Cursor's hardening guidance, including restricting extensions to approved publishers and using an installation cooldown so a newly published version is not installed immediately.

Why this matters for NTx clients

This is a software supply-chain problem with an AI-tool label on it. A coding assistant extension runs with the trust of the developer workstation: source code, credentials in environment variables, and often access to the same systems that person uses to ship client work. That is a close cousin of the risk we already talk about on WordPress Security, where a compromised plugin can look official and still run with trusted access.

For firms that have started letting staff use Claude Code, Cursor, GitHub Copilot, or similar assistants, an AI Readiness conversation should include where those tools come from, who is allowed to install marketplace extensions, and what happens if a workstation with production access is affected. That is part of the exposure review in our AI Consulting work, not a reason to pretend every new coding agent is automatically safe.

Related reading: our overview of AI security, fake AI apps, and the EU AI Act.

FAQ

Which Claude Code versions were malicious?

Cursor identified malicious Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS in the Cursor VS Code Extension Marketplace. Cursor later updated its notice to include both versions. Microsoft analyzed the same two version numbers.

Did attackers break into Anthropic?

Microsoft says Anthropic confirmed that Anthropic's systems were not compromised and that Anthropic did not develop the malicious package posted in the Cursor marketplace. The Hacker News quoted Anthropic staff saying official VS Code and Open VSX channels were not affected.

If the SSH tunnel failed, is the computer fine?

Not necessarily. Cursor and Microsoft both say administrator rights blocked the local SSH service on most macOS and Windows hosts, which would stop a login through that tunnel. The malware could still add an SSH key, install persistence, and send host details. Uninstalling the extension does not remove files written outside its directory.

How do I check a Mac or Windows PC?

Cursor published commands to search SSH authorized_keys files for the comment svc-telemetry, plus remediation scripts for macOS and Windows. Microsoft published a longer list of files, startup objects, and hunting guidance. Use those official pages rather than a third-party recap alone.

Is this the same problem as a compromised WordPress plugin?

It is the same class of risk: software installed from a marketplace that looks legitimate and then runs with trusted access. The technical details are different. On a developer workstation the trusted access is code, credentials, and connected systems. On a WordPress site it is the web server and visitor data.

Sources

1. Microsoft Security Research, "Inside a malicious Claude Code-branded extension and its persistent SSH backdoor," Microsoft Security Blog, October 30, 2026. https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/
2. Cursor Team, "Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace," October 29, 2026, updated October 30, 2026. https://cursor.com/blog/claude-code-extension-security-notice
3. Ravie Lakshmanan, "Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor," The Hacker News, October 30, 2026. https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html