A fake Claude Code update sat on Cursor’s marketplace for 11 hours and planted a backdoor

Eleven hours on Cursor’s marketplace

A tampered version of Anthropic’s Claude Code extension was served on Cursor’s VS Code extension marketplace on October 29, 2026, between about 2:27 a.m. and 1:35 p.m. Pacific time. According to Cursor’s security notice, the affected versions are Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS. It didn’t arrive as a separate fake extension but as an ordinary update under the real extension’s identity, so users with automatic updates may have installed it without noticing. Cursor said in its post on X that at most 5,000 users were affected.

Cursor said it removed the malicious version, temporarily shut down the marketplace as a precaution, audited access and confirmed that no other extensions had been tampered with, rotated keys, rebuilt the marketplace and worked with the hosting provider to take the attacker’s server offline. The company asked all users to update the extension to version 2.1.314. Cursor became part of SpaceX this year, and its X account carries a “SpaceX Super Intelligence” affiliation badge.

Cursor@cursor_ai

We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.

In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.

If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: cursor.com/blog/claude-code-extension-security-notice

Security teams including OpenSourceMalware and Phorion analyzed the malware in detail. Early reports said it was also on the Open VSX registry; The Hacker News corrected that. Microsoft and Socket found no sign that 2.1.313 reached Open VSX, Microsoft’s Visual Studio Marketplace or npm.

What the malware did

According to The Hacker News, the attacker inserted a 66-line loader ahead of the legitimate code in the extension’s main JavaScript bundle. The loader ran as soon as the extension loaded; users didn’t have to send Claude anything. According to Cursor’s notice, the malware did the following.

It sent the attacker the hostname, username, operating system, architecture, home directory, working directories, Git email address and public IP address. It collected the names of environment variables, not their values; according to The Hacker News, it sent the names of up to 40 variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP. The data went to the attacker’s server over unencrypted HTTP on port 8099.

It added an ed25519 key with the comment “svc-telemetry” to the user’s ~/.ssh/authorized_keys file. It then tried to enable the SSH service and open a reverse SSH tunnel to the attacker’s server at 134.209.82.225. To make the tunnel persistent, it installed a LaunchAgent on macOS and, on Windows, a scheduled task named “SysMon” running as SYSTEM plus a fallback script in the Startup folder; there was also a cron entry for Linux. Background scripts retried the tunnel about every 60 seconds.

The odd part is that the attack’s most critical step didn’t work on most machines. According to Cursor, enabling the SSH service requires admin rights, which the extension lacks on most macOS and Windows machines. The notice adds that errors in the malicious code also made this step fail, except in unusual cases where Cursor was started with administrator privileges. The security firm Phorion also reported a bug in the malware’s macOS setup logic. Even so, Cursor stresses that the key was still added, persistence was still installed and host details were still sent, so cleanup is needed either way.

Anthropic: our systems were not compromised

Anthropic said the incident did not originate in its systems. According to Felix Rieseberg of the Claude Code team, it wasn’t a compromise of Anthropic’s systems or employee laptops; a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the extension, which Anthropic didn’t build or publish. The versions on Anthropic’s official channels were not affected.

Felix Rieseberg@felixrieseberg

We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.

Cursor @cursor_ai

We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions

Microsoft Threat Intelligence also confirmed that the malicious packages were never published on the Visual Studio Marketplace or in the anthropic-ai/claude-code package on npm, and said all evidence suggests the incident is limited to Cursor’s marketplace. How the attacker got access to Cursor’s marketplace to publish under Anthropic’s extension identity hasn’t been explained yet, and Cursor’s notice doesn’t say.

Microsoft Threat Intelligence@MsftSecIntel

On October 29, 2026, Cursor reported that a tampered copy of Claude Code extension (anthropic.claude-code, version 2.1.313 and 2.1.312) was available and served on the Cursor extension marketplace for a few hours. msft.it/6019aF20x

Microsoft has confirmed that the malicious packages found on Cursor marketplace were never published nor distributed from the Microsoft Visual Studio Marketplace extension and the npm anthropic-ai/claude-code, which were not affected by this incident.

Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace. At this time, all evidence suggests that the incident is limited to the Cursor marketplace.

Microsoft Threat Intelligence analyzed the JavaScript embedded into the malicious extension package. The injected loader runs when the extension module loads and attempts to add an attacker-controlled Secure Shell (SSH) key, enable the local SSH service, establish reverse SSH forwarding, configure persistence, and report host details.

Successful remote access depends on host privileges, SSH configuration, and the attacker’s server configuration; however, the loader may still write keys and persistence artifacts even when tunnel access fails.

Read the blog for technical analysis and guidance on identifying affected systems, investigating endpoint and network activity, and removing confirmed malicious SSH keys and persistence artifacts.

The Replit CEO’s Binance question

The incident was debated on X too. On October 30, Replit CEO Amjad Masad wrote that “an official Claude Code extension was compromised” and that the story was massively underreported, then asked whether it could be behind the Binance hack. According to the timeline he shared, funds began leaving Binance shortly before the malicious version was pulled from the marketplace. Chainalysis says the outflows began around 20:20 UTC on October 29; Cursor says the version was removed at 20:35.

The question isn’t baseless. In its first update on the incident, which affected about $6.3 billion in assets, Binance said the attack may involve a compromised DevOps engineer’s laptop. Co-CEO Richard Teng later said the attack was not a single “one-click” action, and Binance has yet to publish a root cause. Security researcher Kevin Beaumont also wrote on October 30 that he had confirmed Binance uses Claude Code on Cursor with this extension.

On the other hand, no finding has confirmed a link between the two incidents. According to The Hacker News, TRM Labs says preparations for the attack began at least 36 hours before the theft, which is before the fake version was on the marketplace. Chainalysis and TRM Labs attribute the hack to the North Korea-linked TraderTraitor group, while Elliptic urges caution about attribution until a root cause is published. Chainalysis’s assessment doesn’t mention Claude Code or Cursor.

Amjad Masad@amasad

Massively underreported: an official Claude Code extension was compromised and installed backdoors on developer machines.

Could it be behind the Binance hack?

Anthropic’s Alex Albert replied to Masad that this was not an official Claude Code extension but a tampered copy that Anthropic didn’t build or publish. The Hacker News, for its part, quipped “of course it wasn’t” at Cursor’s statement that the version “was not developed by Anthropic”; its point was that the fake version appeared to users as an update to the extension they trusted.

Alex Albert@alexalbert__

This was not an official Claude Code extension. It was a tampered copy of the Claude Code extension, which we didn’t build or publish. See here: x.com/felixrieseberg…

Felix Rieseberg @felixrieseberg

We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our

What affected users should do

Cursor’s notice covers macOS and Windows users who installed or updated to version 2.1.312 or 2.1.313 from Cursor’s marketplace during the October 29 window. The first recommended step is to check ~/.ssh/authorized_keys for a key with the comment “svc-telemetry”. Cursor provides a one-line search for macOS and a PowerShell command for Windows.

Machines with signs of compromise should be isolated, and the unauthorized key, persistence scripts and tunnel processes removed. Cursor says uninstalling the extension may not be enough and recommends considering a rebuild. It has published cleanup scripts, run as the affected user on macOS and as administrator on Windows, which exit with an error if anything remains. Finally, all passwords, API keys and sessions that were reachable from that machine should be rotated from another trusted device.