Cursor Marketplace Extension Compromise 2026: How a Tampered Claude Code Update Planted an Attacker SSH Key

On 29 October 2026, the AI code editor company Cursor disclosed that its VS Code extension marketplace had served a malicious copy of Anthropic's Claude Code extension as an ordinary update. Versions 2.1.312 and 2.1.313 of Anthropic.claude-code for macOS and Windows were available for about 11 hours, from roughly 2:27am to 1:35pm Pacific time. According to Cursor, the tampered extension sent host and user details to an attacker server, tried to add an attacker SSH key to the user's authorised keys, enable SSH and open a reverse SSH tunnel, and set up persistence. Cursor says the malicious versions "were not developed by Anthropic", and Anthropic says the attacker used access to Cursor's marketplace, not its own systems. Sophos reports that Cursor estimates up to 5,000 users were affected. Cursor pulled the versions, took the marketplace offline, rotated keys and rebuilt it. Neither company has explained how the package was published, and uninstalling the extension does not remove the backdoor.

At a glance

What happened

Cursor is an AI code editor built on VS Code, and it runs its own extension marketplace. Anthropic's Claude Code extension, which connects the editor to the Claude Code coding agent, is one of the extensions developers install there. Extensions update automatically, so whatever the marketplace serves under a trusted publisher's name is installed and run with the developer's own rights.

According to Cursor's security notice, published on 29 October 2026, malicious versions 2.1.312 and 2.1.313 of Anthropic.claude-code for macOS and Windows were available through the Cursor VS Code Extension Marketplace between about 2:27am and 1:35pm Pacific time that day. Cursor says the extension collected the hostname, username, operating system, architecture, home directory, environment variable names, working directories, Git email and public IP, and sent them to an attacker-controlled server. It tried to add an attacker SSH key to authorized_keys, enable the SSH service and open a reverse SSH tunnel, and to keep the tunnel alive through a macOS LaunchAgent or a Windows scheduled task, retrying about every 60 seconds. Cursor notes that enabling SSH would usually fail without administrator privileges. Sophos, which summarises analysis by Phorion, says "coding errors" mean SSH enablement fails on most macOS and Windows hosts. Techzine reports that even so, the key was added, persistence was established and host data was forwarded.

Cursor's notice states: "These malicious versions of the extension were not developed by Anthropic." Cursor says it removed the versions, blocked further distribution, temporarily shut down the marketplace, audited access, confirmed no other extensions had been tampered with, rotated keys, rebuilt the marketplace and worked with the hosting provider to take the attacker's server offline. It found no evidence that other versions or the official distribution were affected. The Register reports Anthropic's position, quoting Anthropic's Rieseberg: "A malicious actor used access to Cursor's marketplace to publish a tampered copy". The Register adds that neither company has explained how the package got onto the marketplace. On the number of victims, Sophos says Cursor estimates up to 5,000 users were affected; The Register describes the figure as alleged by security figures and does not confirm it.

The case sits in a long line of developer extension compromises, including the GlassWorm campaign 2025 and the Amazon Q Developer extension compromise 2025. What sets it apart is that the publisher, Anthropic, was not compromised at all: the trusted channel in between was.

Timeline

How it happened: the identity attack path

1. Marketplace publishing access. The attacker gained the ability to publish under the Anthropic.claude-code listing in Cursor's marketplace. Anthropic says this was access to Cursor's marketplace; how it was obtained has not been disclosed.
2. Trusted update delivered. The tampered build was served as a routine update of a well-known extension, so it ran with each developer's own rights without any new prompt.
3. Reconnaissance sent out. The extension sent host and user details, including Git email, public IP and environment variable names, to an attacker server, giving the attacker a map of each machine.
4. New identity planted. It added an attacker SSH key, labelled svc-telemetry, to the user's authorised keys, creating a standing credential for remote access.
5. Persistent tunnel attempted. It tried to enable SSH and hold open a reverse tunnel through a LaunchAgent or scheduled task. This usually failed without administrator rights, but the persistence scripts outlive uninstalling the extension.

Impact

• Confirmed: Two tampered versions were distributed through Cursor's marketplace for about 11 hours on 29 October 2026, and Cursor confirmed the payload's behaviour and published remediation scripts.
• Reported scale: Up to 5,000 users, according to Cursor's estimate as reported by Sophos; Techzine reports the same figure. The Register treats the number as alleged and it has not been independently confirmed.
• On infected hosts: Host and user data sent to the attacker; the attacker SSH key and persistence installed in some cases, according to Techzine and The Register. The reverse tunnel usually failed without administrator rights.
• Potential: On hosts where the tunnel worked, the attacker could reach credentials and sessions on the machine, which is why Cursor tells users to rotate them from a trusted system.
• Not affected: Cursor found no other tampered extensions and no evidence that other versions or the official distribution were affected. Anthropic says its own systems were not involved.

What this means for NHI and AI agent security

Two non-human identities sit at the centre of this incident. The first is the publishing access that let someone push an update under Anthropic's name in Cursor's marketplace: whoever holds that access is, in effect, trusted on every machine with the extension installed. The second is the attacker's SSH key, a new machine credential quietly added to developers' authorised keys. It does not need the extension to keep working, so removing the extension leaves the identity in place. That is why Cursor warns that uninstalling may not be enough.

The agent angle matters too. AI coding agents and their extensions live on developer machines with access to source code, Git identities, cloud CLIs and environment secrets, which makes them a valuable target for impersonation. Our Developer Workstation and IDE Security Guide covers how to control extensions and what they can reach, and our SSH Key Management Guide explains how to inventory authorised keys so an unknown one stands out. For the distribution side, see our Software Supply Chain Security Guide.

Recommendations

• Check for the attacker key and remove it. Search authorized_keys on macOS and both user and administrator files on Windows for the svc-telemetry comment, then remove the key, the persistence entries and any tunnel processes using Cursor's scripts. See our SSH Key Management Guide.
• Rotate what the host could reach. On any machine that ran the payload, rotate Git, cloud, API and session credentials from a separate trusted system, and consider rebuilding the host. See our Leaked Credential Response Playbook.
• Do not treat uninstalling as clean-up. The persistence scripts run independently of the extension. Confirm removal with your EDR and the published indicators rather than the extension list.
• Control which extensions update automatically. Allow-list approved extensions, pin versions for tools with broad access such as AI coding agents, and stage updates before wide rollout. See our Developer Workstation and IDE Security Guide.
• Alert on new SSH keys and services. Monitor developer endpoints for changes to authorised keys, SSH being enabled and outbound reverse tunnels, which ordinary development rarely needs.
• Hold marketplace operators to publisher integrity. Ask any marketplace you rely on how it protects publishing access and verifies that a build really comes from the named publisher. See our Software Supply Chain Security Guide.

Frequently asked questions

Was Anthropic hacked in the Cursor Claude Code extension incident?

Anthropic says no. Cursor's notice states the malicious versions "were not developed by Anthropic", and The Register reports Anthropic's position that a malicious actor used access to Cursor's marketplace to publish a tampered copy. Neither company has explained how that access was obtained, and Cursor found no evidence that the official distribution was affected.

How do I know if the malicious Claude Code extension affected me?

You are at risk if you used Cursor and installed Claude Code extension version 2.1.312 or 2.1.313 on 29 October 2026. Cursor advises searching your SSH authorised keys for a key with the comment svc-telemetry and checking for the persistence entries in its notice. Uninstalling or updating the extension does not remove the backdoor.

How many users were affected by the Cursor marketplace compromise?

Sophos and Techzine report that Cursor estimates up to 5,000 users were affected. That is an upper bound, not a confirmed count, and The Register treats it as an allegation. The reverse tunnel usually failed without administrator rights, so not every affected machine gave the attacker remote access.

Related NHI Mgmt Group resources

GlassWorm campaign 2025 · Amazon Q Developer extension compromise 2025 · Developer Workstation and IDE Security Guide · SSH Key Management Guide · Software Supply Chain Security Guide

How NHI Mgmt Group can help

This incident shows how trust in a distribution channel turns into machine credentials on thousands of developer laptops. Our NHI Foundation Level training, including its agentic AI section, covers publishing identities, SSH key governance and the controls that keep AI coding agents and their extensions in check, and our advisory team helps engineering and security teams put them in place. See our NHI and AI agent security training.

References

• Cursor: Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) (29 October 2026)
• Sophos: Malicious Claude Code extension distributed through Cursor marketplace (October 2026)
• The Register: Anthropic: That Claude Code extension compromise... couldn't be us (30 October 2026)
• Techzine: Malicious Claude Code extension in Cursor installs SSH backdoor (30 October 2026)