IMPLICATOR
A maliciously modified version of Anthropic's Claude Code extension was available in Cursor's VS Code Extension Marketplace between about 2:27 a.m. and 1:35 p.m. Pacific on Thursday, Oct. 29. The extension ran code that attempted to install a persistent SSH backdoor. Cursor, the coding-tool company owned by SpaceX, said the incident affected up to 5,000 users.
Extensions auto-update in Cursor by default. The extension updated itself in Cursor to the malicious version.
"A malicious actor used access to Cursor's marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this," Anthropic said.
What Changed
- A maliciously modified Claude Code extension was available in Cursor's VS Code Extension Marketplace from about 2:27 a.m. to 1:35 p.m. Pacific on Oct. 29; Cursor said up to 5,000 users were affected.
- The code collected host details and attempted to add an attacker-controlled SSH key, enable the local SSH service and open a reverse SSH tunnel.
- Cursor said a key step would have failed on most machines, but its notice says the extension added the attacker's key, installed persistence and sent host details.
- Anthropic said it was not involved with building, publishing or hosting the extension; neither company has explained how attackers gained control of the account.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
What the code did
Cursor's notice names versions 2.1.312 and 2.1.313 for Windows and macOS and says they were not developed by Anthropic. The code collected host and user details, including the hostname, username, environment variable names, configured Git email and public IP. It attempted to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel. It attempted to make that tunnel persistent through a LaunchAgent on macOS or a scheduled task on Windows.
An analysis by Paul McCarty of OpenSourceMalware found a malicious 66-line loader inserted before the legitimate extension code. A user did not need to begin a Claude conversation. Loading the extension module was enough.
FREE · ABOUT FIVE MINUTES
Keep watch on the AI tools on your machine.
Implicator cuts the flood to the developments worth your attention, with concise reporting on what changed and why it matters. Delivered every weekday at 4:45 a.m. Pacific, 7:45 a.m. Eastern.
From San Francisco. No spam. Unsubscribe anytime.
The implant gathered the names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP. Their values were not placed directly in the initial beacon. Phorion, the security firm that first noticed the activity on endpoints, said the theft of those names let the operator take inventory of cloud credentials and API tokens on a machine, likely to prioritize which machines to target in follow-up attacks.
Where the attack broke down
Cursor said a key step would have failed on most machines. Turning on the local SSH service requires admin rights, which the extension does not have on most macOS and Windows hosts. On those hosts the attacker could not have logged in through the tunnel. The attacker's server no longer functions, because Cursor worked with the cloud provider hosting it to take it offline.
Despite the coding flaws, Phorion said, "the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator." Cursor's notice says the extension added the attacker's SSH key, installed persistence and sent host details to the attacker.
Cursor says it removed the version on detection and shut down the whole marketplace as a precaution before rebuilding it and bringing it back online. It says it audited access and confirmed no other extensions were tampered with. McCarty's analysis lists the npm package, the OpenVSX extension and the Microsoft VS Code extension for Claude as not malicious.
Know someone who'd find this useful? ✉️ Email it to a friend in one click, or they can subscribe free here.
What to check
Cursor's advice covers anyone who installed or updated to 2.1.312 or 2.1.313 from its marketplace on macOS or Windows during the window. The malicious extension appends the attacker's public key, labeled svc-telemetry, to the SSH authorized keys file. If that key is there, the machine is impacted.
Anthropic replaced the compromised version with 2.1.314, researcher Kevin Beaumont said. Cursor warns that uninstalling the extension may not be sufficient, because the payload drops standalone persistence scripts that keep running. It tells affected users to rotate credentials and sessions from a trusted system.
The account question
Beaumont and Phorion said version 2.1.313 was distributed through Anthropic's official account on Cursor. "It was a supply-chain compromise where the attacker gained access to the official distribution channel," Luke Roberts, Phorion's CTO and co-founder, told Ars Technica.
As of Friday, Anthropic had yet to issue public notice of the incident to customers. Neither Cursor nor Anthropic has explained how the attackers gained control of the account.
Frequently Asked Questions
Which versions of the Claude Code extension were affected?
Cursor's notice names versions 2.1.312 and 2.1.313 for Windows and macOS, distributed through Cursor's VS Code Extension Marketplace between about 2:27 a.m. and 1:35 p.m. Pacific on Oct. 29. McCarty's analysis lists the npm package, the OpenVSX extension and the Microsoft VS Code extension for Claude as not malicious.
How can I tell whether my machine was hit?
The malicious extension appends the attacker's public key, labeled svc-telemetry, to the SSH authorized keys file. If that key is there, the machine is impacted.
Does uninstalling or updating the extension remove the backdoor?
Not on its own. Cursor warns that uninstalling may not be sufficient, because the payload drops standalone persistence scripts that keep running. Cursor tells affected users to rotate credentials and sessions from a trusted system.
Could the attacker actually log in to infected machines?
Cursor said a key step would have failed on most machines, because turning on the local SSH service requires admin rights the extension lacks on most macOS and Windows hosts. The attacker's server no longer functions. Phorion still said the malware installs persistence and beacons host reconnaissance back to the operator.
How did the tampered version get published?
Beaumont and Phorion said version 2.1.313 was distributed through Anthropic's official account on Cursor. Anthropic said it was not involved with building, publishing or hosting the extension. Neither Cursor nor Anthropic has explained how the attackers gained control of the account.
AI-generated summary, reviewed by an editor. More on our AI guidelines.
Free AI briefing · Weekdays
The AI stories that matter, sourced and explained.
Join the Morning Briefing. It goes out every weekday at 4:45 a.m. Pacific, with later sends for the East Coast, Berlin and Tokyo.
Free when you sign up: The Paperclip Compendium, our tested guide to running AI agents.
Free. Unsubscribe in one click.
Marcus Schuler
Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai
