On 29 October Cursor, the maker of an AI code editor, found that its extension marketplace had been serving a malicious copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, from about 2:27am to 1:35pm Pacific time (09:27 to 20:35 UK time). The code tried to add an attacker's SSH key, open a hidden tunnel and survive restarts. Cursor says the versions were not developed by Anthropic, and Anthropic says its own systems were not compromised.
What happened
Cursor is an AI-assisted code editor built on Visual Studio Code, with its own marketplace for add-ons called extensions. In its security notice, Cursor says that between about 2:27am and 1:35pm PT on 29 October a maliciously modified version of Anthropic's Claude Code extension was available there, as versions 2.1.312 and 2.1.313 for Windows and macOS. Cursor removed it, then shut the whole marketplace, audited access, rotated its keys and brought it back online. It says no other extensions were tampered with.
WIRED reports that Cursor says the malicious extension was downloaded by "at most 5,000 users", and Ars Technica, which reported the incident on 30 October, gives the same figure for version 2.1.313; Cursor's security notice itself does not include a number. Security firm Phorion's co-founder Luke Roberts told Ars the malicious version was posted to the official Anthropic account on Cursor's marketplace. Neither company has explained how the attacker got that access. Ars also quotes Roberts saying extensions in Cursor update automatically by default, which is how a new malicious version can reach machines without anyone choosing to install it.
What the malicious code did
According to Cursor, the code collected host and user details, including the computer's name, user name, Git email address, public IP address and the names of environment variables. It then tried to add an attacker-controlled SSH key, which would let someone log in to the computer remotely. It also tried to turn on the local SSH service, open a reverse tunnel to the attacker's server and set itself up to restart after a reboot. Phorion's analysis adds that it gathered only variable names, not their values, which gives an attacker a list of which machines hold cloud keys or API tokens worth targeting next.
Bugs limited the damage. Cursor says that turning on SSH needs administrator rights the extension does not have on most Mac and Windows computers, so on those machines the attacker could not log in through the tunnel. Cursor also worked with the hosting provider to take the attacker's server offline. The key, the persistence scripts and the report to the attacker still went through, and Cursor warns that uninstalling the extension "may not be sufficient" because separate scripts keep running.
Anthropic's position
Cursor's notice says the malicious versions "were not developed by Anthropic". WIRED quotes Felix Rieseberg of Anthropic's technical staff on X: "it wasn't a compromise of Anthropic's systems or employee laptops. A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension." Microsoft's threat intelligence team says Anthropic confirmed to it that its systems were not compromised, and that the malicious packages were never published on Microsoft's Visual Studio Marketplace or on npm. Microsoft says all evidence so far suggests the incident is limited to Cursor's marketplace.
Who should act
Anyone who installed or updated the Claude Code extension in Cursor on Windows or macOS during that window on 29 October should follow Cursor's notice, which includes a check for the attacker's key and clean-up scripts. Cursor's advice also covers isolating affected machines and rotating passwords, keys and sessions those computers could reach, from a different, trusted computer. The affected builds Cursor lists are for Windows and macOS, but Cursor's indicators and Phorion's analysis also describe Linux steps in the code, so Linux users of the extension in Cursor should check against the same notice. Claude Code installed from Anthropic's own channels or from Microsoft's marketplace is not affected, according to Anthropic and Microsoft.
What this means for a business using AI coding tools
Evoogen's reading: AI coding assistants usually arrive as extensions that run with the same access as the editor, which means the developer's files, source code and saved credentials. An extension marketplace is part of your supply chain, and automatic updates mean you trust whoever controls the publisher account at that moment, not just the publisher's name.
For a small team or a business that hires freelance developers, three questions are worth asking now: which AI extensions are installed on machines that hold client data or cloud keys, and from which marketplace; whether updates install automatically on those machines; and whether cloud keys sit in plain environment variables on laptops rather than in a password manager or secrets store. None of this needs new software to answer, and the answers show where one bad update could reach.
If you want AI coding and automation tools set up with sensible access, update and credential controls for your team, Evoogen can review your setup and implement the changes. Talk to Evoogen about safe AI tooling.
Sources
Evoogen checked these sources on 2 November 2026. Company and research claims stay attributed to their source; Evoogen analysis is labelled.
- Ars Technica: Anthropic VS code extension on Cursor backdoored for nearly 12 hours — checked 2026-11-02
- Cursor: Security notice on malicious Anthropic.claude-code 2.1.312 and 2.1.313 — checked 2026-11-02
- Microsoft Security Blog: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor — checked 2026-11-02
- Phorion: Official Claude Code Extension Compromise: Security Advisory — checked 2026-11-02
- WIRED: A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices — checked 2026-11-02