Cursor has removed a malicious version of Anthropic's Claude Code extension from its extension marketplace after discovering the package had been modified to install a persistent SSH backdoor on developer machines. In a security notice published on October 29, Cursor said the trojanized package — listed as Anthropic.claude-code version 2.1.313 — was not developed by Anthropic, and that at most 5,000 users were affected. According to Reuters, the company is reaching out to those users directly.
The disclosure is a jarring reminder that the AI coding tools developers now trust with their source code, credentials, and shell access are themselves supply-chain targets. For more context on the security pressures building around AI developer tooling, see our AI industry coverage.
A Two-Hour Distribution Window
According to Cursor's timeline, the malicious version of the extension was available in its marketplace between roughly 2:27 a.m. PT and 1:35 p.m. PT on October 29 — a window of about eleven hours. During that period, any developer who installed or updated to version 2.1.313 of the Claude Code extension received the tampered package rather than code produced by Anthropic.
Cursor said it removed the malicious version from the marketplace immediately upon detection and blocked further distribution. The company then went a step further, temporarily shutting down its entire extension marketplace out of what it described as an abundance of caution.
What the Malicious Extension Did
Cursor's security team documented the extension's behavior in unusual detail. Once installed, the package ran code that attempted to establish a persistent backdoor through several stages:
- Reconnaissance. The extension collected the machine's hostname, username, operating system, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP address.
- SSH key injection. It attempted to add an attacker-controlled SSH key to the machine's `authorized_keys` file, enable the local SSH service, and open a reverse SSH tunnel back to a server controlled by the attacker.
- Persistence. Background scripts retried the reverse tunnel roughly every 60 seconds. On macOS, the malware tried to make the tunnel persistent through a LaunchAgent; on Windows, it attempted to register a scheduled task running as SYSTEM, with a startup-script fallback.
- Beaconing. The infected machine reported host details and backdoor status via an HTTP POST request to a `/beacon` endpoint on port 8099.
Why the Damage May Be Limited
There are two important mitigating factors. First, enabling the local SSH service requires administrator rights, which the malicious extension does not have on most macOS and Windows machines. Cursor noted that outside of highly unusual circumstances where the editor was started with administrator privileges, errors in the malicious code caused this step to fail — meaning the attacker likely could not log in through the tunnel on those hosts. The extension still managed to add the attacker's SSH key, install its persistence mechanisms, and send host details to the attacker's server, however.
Second, the attacker's infrastructure is now offline. Cursor said it worked with the cloud provider hosting the command-and-control server to take it down, so the reverse shell and the host-detail beacon are no longer functional.
The company also stated that it has no evidence any other versions of the extension or Anthropic's official distribution channels were affected.
Marketplace Shutdown, Audit, and Rebuild
Cursor's response went beyond removing the single bad package. The company said it conducted a full audit of marketplace access and confirmed that no other extensions had been tampered with, rotated its keys, rebuilt the marketplace infrastructure, and brought it back online. Developers who installed or updated to version 2.1.313 during the exposure window are being urged to follow the remediation steps and indicators of compromise — covering SSH activity, files and persistence mechanisms, and process activity — that Cursor published alongside its notice.
A Warning Shot for the AI Tooling Ecosystem
The incident illustrates how the economics of AI-assisted development have changed the calculus for attackers. A single trojanized version of a popular extension, live for a matter of hours, potentially reached thousands of developer workstations — machines that typically hold source code, cloud credentials, and access to production systems.
It also highlights the difference between official distribution channels and third-party marketplaces. Anthropic's Claude Code extension is distributed through established channels, but Cursor operates its own marketplace for its VS Code-based editor, and it was that marketplace's listing which was compromised. As AI coding assistants become standard equipment across the software industry, the integrity of the registries that distribute them becomes a security perimeter in its own right — one that, until this week, relatively few organizations thought to audit.
For the up to 5,000 affected users, the immediate priority is running through Cursor's remediation checklist. For everyone else, the episode is a reason to review which extensions have deep access to their development environments, and to think twice before letting an update install silently.
---
Get the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
