Malicious Claude Code extension hit up to 5,000 Cursor users

Summary

• Two malicious versions of the Anthropic.claude-code extension circulated on Cursor's marketplace for roughly 11 hours.
• Cursor said the payload harvested machine data and attempted SSH persistence on macOS and Windows.
• Removing the extension does not end the compromise; Cursor urged credential rotation from a trusted device.

The latest

Two trojanized builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313, were distributed through Cursor's VS Code extension marketplace on 29 October 2026, Cursor said in a security notice. The company put the exposure window at roughly 2:27 a.m. to 1:35 p.m. Pacific time and said in a post on X that up to 5,000 users were affected.

Details

• The payload: According to Cursor, the code collected hostname, username, operating system, architecture, home directory, environment variable names, working folders, Git email and public IP address, then sent them to an attacker-controlled server, since taken down in coordination with the hosting provider.
• The persistence: Cursor said the code tried to append an attacker key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel. It also attempted a LaunchAgent on macOS and a SYSTEM-level scheduled task on Windows, with a startup-folder fallback, while background scripts retried the tunnel roughly every 60 seconds.
• Why removal isn't enough: Cursor said uninstalling the extension may not be sufficient, because the payload drops independent persistence scripts that keep running. It told affected users to complete the full remediation sequence even when the SSH step appears to have failed, since the key and persistence mechanisms can be written regardless.
• Microsoft's analysis: In a 30 October 2026 analysis, Microsoft said the injected JavaScript runs when the extension module loads, ahead of its normal code. It logs the names, not the values, of environment variables containing strings such as KEY, TOKEN and SECRET, disables host key verification, and suppresses output and errors so the extension appears to work normally.
• Scope limits: Cursor said the versions were not built by Anthropic and that no other marketplace extensions, products or distribution channels showed evidence of tampering. Microsoft confirmed the packages were never published to the Visual Studio Marketplace or npm, and said Anthropic reported its own systems were not breached.
• Indicators of compromise: Cursor listed the attacker address 134.209.82.225, with reverse SSH on port 22 and a beacon on port 8099, a LaunchAgent named com.apple.sysmond on macOS, a scheduled task named SysMon on Windows, an @reboot cron entry on Linux, and a public key labeled svc-telemetry in authorized_keys.
• The remediation: Cursor advised isolating machines showing payload execution, deleting the key, persistence mechanisms and tunnel processes, rotating credentials and sessions from a trusted device, and running the remediate-macos.sh and remediate-windows.ps1 scripts. Microsoft recommended preserving evidence before cleanup and rebuilding hosts where trust cannot be restored.
• Cursor's response: The company said it pulled the malicious version on detection, blocked further distribution, took the marketplace offline temporarily, audited access, rotated keys and rebuilt the marketplace before restoring service. It directed inquiries to security@cursor.com and said it would contact affected users directly.
• The clean build: The Hacker News reported on 30 October 2026 that Anthropic published version 2.1.314 to Open VSX and the VS Code marketplace. It described the malicious loader as 66 lines inserted ahead of the original extension code, credited the initial research to OpenSourceMalware, and said how the build reached the marketplace remains unclear.

Between the lines

The hardest part of this incident for defenders is the design Microsoft described: output suppression and swallowed errors mean the extension keeps behaving normally while writing keys and persistence artifacts. That is why Cursor's guidance separates two things most users treat as one — uninstalling the extension, and clearing what it left behind on disk.

What's next

Watch for Cursor's direct outreach to affected users, any account of how the build entered the marketplace, and whether the marketplace adopts the publisher restrictions and extension cooldown period Microsoft recommended.

Source: Cursor, Microsoft, The Hacker News