Anthropic denies breach as tampered Claude Code extension hits Cursor users

A tampered copy of Anthropic’s Claude Code extension sat in Cursor’s extension marketplace for about 11 hours on Thursday 29 October. It reached up to 5,000 users. The malicious versions tried to plant an SSH backdoor on developers’ machines, Cursor said in a security notice.

Anthropic says nobody breached its own systems. A security firm that studied the attack says the extension went out through Anthropic’s official account on Cursor. Neither Anthropic nor Cursor has said how the attacker got access.

What Cursor found

The affected versions were 2.1.312 and 2.1.313 for Windows and macOS. They were live from about 2:27am to 1:35pm Pacific time. Cursor, which SpaceX acquired earlier this year, said Anthropic did not develop the code.

The extension collected details about each machine and its user, including the hostname, username, Git email and public IP address. It then tried to add the attacker’s SSH key and turn on the computer’s SSH service. It also tried to open a reverse tunnel to the attacker’s server.

That last step needs administrator rights, which the extension lacks on most macOS and Windows machines. So it would usually fail, Cursor said. But the key, the persistence scripts and the data upload still went through. Uninstalling the extension may not be enough to remove them.

We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the http://cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.

In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.

If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: https://cursor.com/blog/claude-code-extension-security-notice

Cursor (@cursor_ai) October 30, 2026

Cursor removed the versions and shut its whole marketplace while it checked the other extensions. It then rotated its keys and reopened it. It also had the attacker’s server taken offline. It has published scripts to check for and remove the backdoor.

Anthropic: ‘didn’t build or publish’

Felix Rieseberg, a member of Anthropic’s technical staff, responded in a post on X.

We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.

Felix Rieseberg (@felixrieseberg) October 30, 2026

The security firm Phorion first flagged the compromise. Its co-founder and chief technology officer, Luke Roberts, told Ars Technica that the attacker reached the official distribution channel.

“The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312,” Roberts told Ars.

Independent researcher Kevin Beaumont made the same point, Dan Goodin reported for Ars. Extensions update automatically in Cursor by default, Roberts said. Cursor has told users to move to a clean version, 2.1.314.

The malware also sent the names of up to 40 environment variables matching keys, tokens and secrets, but not their values, Phorion found. That gives the attacker a quick list of which cloud credentials sit on each machine.

Supply-chain attacks on developer tools have hit npm packages this year, and researchers have warned that AI coding tools could amplify such attacks.