A tampered Claude Code backdoor reached up to 5,000 developers through Cursor's extension marketplace on October 29, 2026, planting a persistent SSH backdoor on their machines before the poisoned build was pulled after about eleven hours. Microsoft Threat Intelligence published a fresh analysis of the incident on October 31, confirming the attack was confined to Cursor's marketplace and laying out exactly what the malicious code did, and why simply uninstalling the extension is not enough to clean an affected computer.

Key Points

• A maliciously modified build of Anthropic's Claude Code extension was available in Cursor's marketplace for about eleven hours on October 29, from roughly 09:27 to 20:35 UTC.
• Cursor says at most 5,000 users received the tampered versions, numbered 2.1.312 and 2.1.313, on macOS and Windows.
• The payload reported host details to an attacker server, added an attacker SSH key labelled "svc-telemetry" and set up persistent startup tasks and a reverse SSH tunnel.
• Microsoft confirmed the tampered packages never appeared in the Visual Studio Marketplace or the npm package for Claude Code, and Anthropic says its own systems were not compromised.
• A clean version, 2.1.314, was published on October 30, and Cursor has issued remediation scripts that affected users must run before rotating credentials from a clean machine.

What Happened

Cursor, the AI-powered code editor built on Visual Studio Code, distributes extensions through its own marketplace. On October 29, a modified copy of the official Claude Code extension, published under Anthropic's name, sat in that marketplace for roughly eleven hours, from about 2:27 a.m. to 1:35 p.m. Pacific time. Cursor's security notice says the tampered build was removed once detected, the whole marketplace was then taken offline, access was audited, keys were rotated and the marketplace was rebuilt before it returned to service. The company says it found no other tampered extensions and will contact affected users directly.

Security researchers at StepSecurity analysed the tampered build on October 30 and found it nearly identical to the legitimate extension, except for a small loader hidden inside its main script file, roughly seven kilobytes larger than the previous clean release. The loader runs as soon as the editor loads the extension, before any conversation with Claude begins, which is what makes it so dangerous: a developer did not need to do anything unusual, only install or auto-update the extension in the affected window.

Microsoft's October 31 analysis, published by Microsoft Threat Intelligence, corroborates the core facts and adds its own detection guidance. Microsoft says it confirmed the malicious packages were never published or distributed through the Visual Studio Marketplace or the npm package for Claude Code, and that Anthropic told Microsoft its systems were not compromised and that it did not develop the package posted to Cursor's marketplace. All evidence, Microsoft said, suggests the incident is limited to Cursor's marketplace.

Background/Context

Claude Code is Anthropic's command-line and editor tool that lets developers hand coding tasks to its Claude model from inside their working environment. Cursor is one of the most popular AI code editors, and its marketplace is the channel through which its users install and update extensions. That combination made the marketplace a high-value target: a single tampered extension, trusted because it carried a familiar name, could reach machines that hold source code, cloud credentials and company repositories.

The incident also lands in a week when AI coding tools have already been under scrutiny. On October 29, separate research disclosed EMBRACE flaws in five AI coding tools, including Cursor, GitHub Copilot, OpenAI Codex, Microsoft VS Code and Anthropic's own tooling, a different issue from the backdoor but one that underlines how much trust developers now place in tools that can read and change their code. And on October 30, OpenAI, Google, Microsoft and Anthropic pledged to honour a single shared opt-out token for AI training data, a sign of how fast the industry's security and governance debates are moving.

Supply-chain attacks on developer tools are not new, but they are rare at this level of polish. The tampered Claude Code build did not announce itself with broken features or crashes. It behaved like the real extension while quietly running its loader in the background, which is why the exposure window matters more than the number of victims: anyone who updated in those eleven hours must assume their machine was touched until checks prove otherwise.

Claude Code Backdoor: What the Payload Did

According to Cursor's notice, StepSecurity's analysis and Microsoft's follow-up, the loader performed a sequence of steps on an affected machine. First, it collected host details, including the host name, user name, operating system, architecture, home folder, Git email address, public IP address and the names of environment variables, and sent them to the attacker-controlled address 134.209.82.225 over plain HTTP. Researchers note it reported the names of environment variables that look like keys or tokens, not their values, but even names can tell an attacker where secrets live.

Second, it appended an attacker-controlled SSH key, labelled "svc-telemetry", to the user's authorized_keys file, the file that decides which keys may log in to that machine. Microsoft's analysis records the key's fingerprint, SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, because the label itself is free text that anyone with access could change, so matching the fingerprint is the reliable check.

Third, it set up persistence outside the extension folder so that removing the extension would not remove the backdoor. On macOS it created a LaunchAgent, reported as com.apple.sysmond; on Windows it created a scheduled task called SysMon and a sysmon.cmd file in the Startup folder; researchers also list a cron line that runs at reboot, plus files named .smt, .smtk and smt.cmd and .stk_ key files in the temporary folder. It also tried to enable the local SSH service and open a reverse tunnel out of the machine, giving an attacker a route back in.

One detail remains disputed and matters for anyone checking their machine. StepSecurity initially pointed to the Open VSX registry as the source, while Cursor has since said the tampered build came from its own marketplace, and Anthropic has said the build was never on Open VSX, the Microsoft marketplace or any of its own distribution channels. StepSecurity also found the 2.1.312 build on Open VSX clean, while Cursor lists both 2.1.312 and 2.1.313 among the bad versions in its own marketplace. The safe course, repeated by every advisory, is to treat either version, installed from Cursor's marketplace on October 29, as in scope. How the attacker got the build into the marketplace in the first place is still not public: Cursor's notice does not say, and researchers note it is unknown whether stolen credentials or another method were used.

Reactions/Quotes

Anthropic has pushed back firmly against early headlines suggesting it had been hacked. Its Felix Rieseberg said the incident was not a compromise of Anthropic's systems or employee laptops, and Anthropic's statement, quoted in security coverage, reads: "A malicious actor used access to Cursor's marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing, or hosting this." Microsoft's analysis echoes that position, recording Anthropic's statement that its systems were not compromised.

Cursor, for its part, has said it removed the version on detection, shut the marketplace down, audited access, found no other tampered extensions, rotated its keys and rebuilt the marketplace before bringing it back. The company says at most 5,000 users received the tampered build and that it will contact them directly. Security researchers have been blunter about the clean-up: uninstalling the extension does not undo the persistence, and affected users must run Cursor's remediation scripts, then rotate credentials from a clean machine, not from the machine that may still be compromised.

Microsoft has published Defender XDR detections and advanced hunting queries keyed to the attacker IP address, the JavaScript entry-point hash ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, the artifact filenames and scheduled-task creation events containing both SysMon and smt, cautioning that a detection is an investigative lead rather than proof of compromise.

Why It Matters

This incident matters far beyond the 5,000 users Cursor counts, because it strikes at the trust model of modern software development. Developers install extensions the way office workers install apps, usually without inspecting the code, and those extensions run with broad access to files, terminals and credentials. A backdoor that survives uninstallation and quietly phones home turns a routine update into a foothold inside a company, and the foothold can then be used to reach source code, cloud infrastructure and customer data.

It also shows how quickly a supply-chain incident can be contained when the distributor acts decisively, and how much confusion can still follow. Cursor's eleven-hour window, marketplace shutdown and key rotation limited the blast radius, yet a full day later researchers were still untangling which registry the build came from and which version numbers were bad. For teams, the lesson is procedural: pin extension versions, audit what developers install, and treat any marketplace incident as a reason to check machines, not just update them.

For individual developers, the stakes are personal as well as professional. The payload collected Git email addresses, home-folder paths and environment-variable names, the kind of details that help an attacker craft convincing follow-up phishing or move laterally into other accounts. Rotating credentials from a clean machine, rather than from the affected one, is the step researchers stress most, because a key rotated on a still-compromised machine can simply be harvested again.

What Happens Next

Cursor's remediation path is now the immediate priority for anyone in scope: check whether Claude Code version 2.1.312 or 2.1.313 was installed or updated from Cursor's marketplace between 09:27 and 20:35 UTC on October 29, run Cursor's check and remediation script for the platform in question, update to version 2.1.314 or later, and then rotate SSH keys, API tokens and other credentials from a machine known to be clean. On macOS, the checks look for the com.apple.sysmond LaunchAgent and the .smt family of files; on Windows, for the SysMon task and sysmon.cmd in Startup; on both, for the attacker's key in authorized_keys and for any cron line that runs at reboot.

Cursor says it will contact affected users directly, and Microsoft's Defender detections give enterprise security teams a way to hunt for the indicators across fleets. The open question, how the build reached the marketplace, is likely to be answered by Cursor's own investigation, and its answer will decide whether the fix is a one-off key rotation or a deeper change to how marketplace publishing is verified. Until then, the incident stands as a warning to every team that treats an extension update as a routine click.

Frequently Asked Questions

Was Anthropic hacked? No, according to Anthropic and Microsoft. Anthropic says a malicious actor used access to Cursor's marketplace to publish the tampered extension, and that Anthropic was not involved in building, publishing or hosting it.

Am I affected if I use Claude Code in VS Code? Microsoft says the tampered packages never appeared in the Visual Studio Marketplace or the npm package, so VS Code users who installed from Microsoft's marketplace are not in scope on current evidence, though checking the installed version is still prudent.

Does uninstalling the extension fix it? No. The payload planted persistence outside the extension folder, so affected users must run Cursor's remediation scripts and then rotate credentials from a clean machine.

Which versions are bad? Cursor lists versions 2.1.312 and 2.1.313 from its own marketplace, installed or updated on October 29. The clean replacement is version 2.1.314, published on October 30.

How many users were affected? Cursor says at most 5,000 users received the tampered build during the roughly eleven-hour window.

Related coverage: Anthropic's IPO filing and the $2 trillion test for Claude's maker, Meta's $95 billion AI raise leads a $198 billion day of AI spending, and Big Tech earnings test for Alphabet, Amazon and Apple.