Cursor says a tampered Claude Code extension tried to backdoor up to 5,000 developers' machines

The skim

• For about 11 hours on Thursday, Cursor's extension marketplace served tampered copies of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, for macOS and Windows. Anthropic didn't make them.
• The fake versions sent host details to an attacker, added an attacker's SSH key and set up persistence. Cursor estimates up to about 5,000 users may have installed them, according to The Verge and Sophos.
• Uninstalling isn't enough. Check your SSH authorized_keys file for a key labeled svc-telemetry. If it's there, clean the machine and rotate your credentials from another computer.

What happened

Cursor, the AI code editor, says the malicious extension was live in its VS Code extension marketplace from about 2:27 a.m. to 1:35 p.m. Pacific on Oct. 29. That's about 9:27 a.m. to 8:35 p.m. UTC. In its security notice, Cursor says the code collected the hostname, username, operating system, home directory, environment variable names, Git email and public IP address. It then tried to add an attacker-controlled SSH key, turn on the local SSH service and open a reverse SSH tunnel. To survive reboots, it installed a LaunchAgent on Macs and a scheduled task on Windows.

There's some good news. Turning on SSH needs admin rights, and Cursor says bugs in the malicious code mean that step failed on most machines unless Cursor was running as an administrator. On those machines, "the attacker could not have logged in through the tunnel," Cursor says. The attacker's server is also offline now, after Cursor worked with its hosting provider. Still, the key, the persistence scripts and the data sent to the attacker are real. Cursor says it pulled the extension, shut down the whole marketplace, rotated its keys and rebuilt the marketplace before bringing it back. On Friday morning it updated the notice with new indicators and clarified which versions were affected.

Cursor hasn't said how the tampered package got into its marketplace. It says it checked access and "confirmed no other extensions were tampered with."

Why it matters

AI coding tools run with deep access to developers' machines, source code and cloud credentials. That makes them an ideal target for attackers. It's the latest in a run of attacks on the add-ons and agents people trust, after 319 Chrome extensions caught hijacking searches and an AGENTS.md trick aimed at coding agents. A well-known name on a marketplace listing doesn't guarantee a safe build.

What to do

If you installed or updated Claude Code from Cursor's marketplace on Oct. 29, run Cursor's check. On a Mac, search ~/.ssh/authorized_keys for svc-telemetry. Cursor's notice has a PowerShell version for Windows and cleanup scripts for both systems. If the key is there, isolate the machine, run the cleanup or rebuild, and rotate any credentials and sessions it could reach. Sophos warns that "uninstalling the extension leaves the backdoor in place," so updating to a clean version alone won't fix an infected machine.

Sources: Cursor, Sophos X-Ops and The Verge.