Agent News Daily

Backdoored Claude Code extension reached up to 5,000 Cursor users

A backdoored Claude Code build sat on Cursor's marketplace for about 11 hours and affected up to 5,000 users, Cursor says. Here is what happened.

2 November 2026

A tampered build of the Claude Code extension for VS Code was offered through the Cursor Marketplace on 29 October. Cursor says up to 5,000 users were affected. According to [BankInfoSecurity](http://www.bankinfosecurity.com/cursor-confirms-anthropic-claude-code-extension-compromised-a-33263), the build was designed to give attackers lasting remote access to any machine that installed it.

The incident targeted the tools developers use to run coding agents, not the agents themselves. Users did not need to start Claude for the malicious code to run.

What happened

BankInfoSecurity reports that the malicious version, numbered 2.1.313, appeared on the Cursor Marketplace at about 9:27 am UTC on Thursday 29 October. It was removed at about 8:35 pm UTC, roughly 11 hours later. That afternoon Cursor took its marketplace offline while it dealt with the malware. Anthropic released a clean version, 2.1.314, that evening.

Cursor said it then reviewed the other extensions on its marketplace, found no further tampering and restored the service late on Thursday, Pacific time. It posted a public security notice on Friday morning, UTC. The security firm Phorion, which first flagged the extension, and the researchers Paul McCarty and Kevin Beaumont published analyses the same day.

According to the researchers, the malicious code sat only in the extension's startup file, so it ran whenever the extension loaded. The reported behaviour included:

  • adding an attacker-controlled SSH key to the user's configuration
  • trying to enable the local SSH service and open a reverse tunnel
  • installing persistence for each operating system
  • collecting host information, including up to 40 environment variables with names suggesting keys, tokens or passwords, and sending it unencrypted over HTTP
  • suppressing error messages

What the companies said

Cursor said the malicious version was not developed by Anthropic and did not affect its other extensions or products. It said the attack server is offline, so the reverse shell and data uploads no longer work. It added that the reverse tunnel would probably fail unless Cursor was running with administrator privileges. However, the SSH key and persistence would still be installed, so infected machines need cleaning. Cursor said it will contact affected users directly.

Anthropic said a malicious actor used access to Cursor's marketplace to publish the tampered copy. It said it had no part in building, publishing or hosting it.

Cursor has not said how the attacker gained the ability to publish to its marketplace, or who was responsible.

What affected users are advised to do

Researchers quoted by BankInfoSecurity advise isolating any machine that had version 2.1.313 installed and carrying out a forensic investigation. Beaumont warned that the replacement version updates automatically but does not undo the earlier changes. He advised manually checking every affected VS Code and Cursor system for the attacker's SSH key and persistence mechanisms. Cursor has published instructions for checking for signs of compromise.

Wider context

In its coverage of a separate breach at Chainalysis, BleepingComputer listed the malicious extension among several security incidents that week. Coding-agent extensions often run with access to developers' credentials and cloud keys, which makes their distribution channels an attractive target.

The detailed timeline and technical findings here come from a single outlet, BankInfoSecurity, which drew on statements from Cursor and Anthropic and on the researchers' published analyses. Other reports that might confirm the details could not be opened.

Sources

Sources