There you have it! A tampered build of the Claude Code extension sat on Cursor's marketplace for …
October 31, 2026 · 0 likes · 0 comments
AI
There you have it! A tampered build of the Claude Code extension sat on Cursor's marketplace for about 11 hours, and Cursor says it reached at most 5,000 users.
https://lnkd.in/e8i_EZFZ
Version 2.1.313 carried the real extension ID, anthropic.claude-code. Not a lookalike name. The real one.
It was live from about 2:27 a.m. to 1:35 p.m. PT on Oct. 29. "This malicious version of the extension was not developed by Anthropic," Cursor said.
The code ran the moment the file loaded. No need to open a chat. It added an attacker key labeled "svc-telemetry" to ~/.ssh/authorized_keys, tried to open a reverse SSH tunnel, and set up persistence on macOS, Linux and Windows. It also sent out hostname, username, Git email, public IP and the names of up to 40 environment variables that look like keys or cloud credentials. Names, not values. Still a target list.
Cursor pulled the package, shut down its whole marketplace, rotated its keys, rebuilt it and got the attacker's server taken offline. Versions 2.1.312 and 2.1.314 are verified clean.
A bug on many macOS and Windows machines kept the attacker from logging in. Researchers say don't count on it.
Still open: how a malicious build got published under the legitimate ID. Neither Cursor nor Anthropic has said. And "at most 5,000" is a ceiling, not a count of actual installs.
I think developer tooling is the new soft underbelly. These tools run as you, with your SSH keys, your cloud credentials and your source code. An extension isn't a plugin. It's code running with your identity.
I've said identity has to be treated like a weapon system. This is why.
And 11 hours is plenty. Most teams take longer than that to read the advisory.
If you installed or updated to 2.1.313 from Cursor's marketplace in that window:
Check ~/.ssh/authorized_keys for svc-telemetry.
Isolate the machine before deleting anything. Uninstalling does not remove the key or persistence.
Rotate every credential that machine could reach, from a clean computer.
Rebuilding beats cleaning.
For everyone else: pin versions, review extensions the way you review dependencies, and run coding agents with least privilege. Who actually checks what auto-updated overnight? Almost nobody. Start.
Full story, just the facts: https://lnkd.in/e8i_EZFZ
https://lnkd.in/e8i_EZFZ
Version 2.1.313 carried the real extension ID, anthropic.claude-code. Not a lookalike name. The real one.
It was live from about 2:27 a.m. to 1:35 p.m. PT on Oct. 29. "This malicious version of the extension was not developed by Anthropic," Cursor said.
The code ran the moment the file loaded. No need to open a chat. It added an attacker key labeled "svc-telemetry" to ~/.ssh/authorized_keys, tried to open a reverse SSH tunnel, and set up persistence on macOS, Linux and Windows. It also sent out hostname, username, Git email, public IP and the names of up to 40 environment variables that look like keys or cloud credentials. Names, not values. Still a target list.
Cursor pulled the package, shut down its whole marketplace, rotated its keys, rebuilt it and got the attacker's server taken offline. Versions 2.1.312 and 2.1.314 are verified clean.
A bug on many macOS and Windows machines kept the attacker from logging in. Researchers say don't count on it.
Still open: how a malicious build got published under the legitimate ID. Neither Cursor nor Anthropic has said. And "at most 5,000" is a ceiling, not a count of actual installs.
I think developer tooling is the new soft underbelly. These tools run as you, with your SSH keys, your cloud credentials and your source code. An extension isn't a plugin. It's code running with your identity.
I've said identity has to be treated like a weapon system. This is why.
And 11 hours is plenty. Most teams take longer than that to read the advisory.
If you installed or updated to 2.1.313 from Cursor's marketplace in that window:
Check ~/.ssh/authorized_keys for svc-telemetry.
Isolate the machine before deleting anything. Uninstalling does not remove the key or persistence.
Rotate every credential that machine could reach, from a clean computer.
Rebuilding beats cleaning.
For everyone else: pin versions, review extensions the way you review dependencies, and run coding agents with least privilege. Who actually checks what auto-updated overnight? Almost nobody. Start.
Full story, just the facts: https://lnkd.in/e8i_EZFZ