A tampered build of Anthropic’s official Claude Code extension, version 2.1.313, was served to Cursor users as a routine update on October 29, 2026. For about 11 hours, anyone who installed or auto-updated it got a Claude Code extension backdoor: an attacker’s SSH key on their machine, a reverse tunnel to a remote server and persistence that survives uninstalling the extension. Cursor says at most 5,000 users were affected, and a clean version 2.1.314 is now out.
Key takeaways
- The malicious build was anthropic.claude-code 2.1.313, published under the real extension ID rather than a look-alike name.
- Exposure window: roughly 09:27 to 20:35 UTC on October 29 (2:27 a.m. to 1:35 p.m. PT; about 2:57 p.m. Oct 29 to 2:05 a.m. Oct 30 IST).
- Cursor says the build was not made by Anthropic and that up to 5,000 users received it. How it got published has not been publicly confirmed.
- Uninstalling the extension does not remove the backdoor. Check for an SSH key labelled
svc-telemetry, remove persistence and rotate credentials.
What happened
According to StepSecurity’s technical analysis, a clean version 2.1.312 of the Claude Code extension shipped on October 27. Around 09:27 UTC on October 29, a version 2.1.313 appeared. It contained the normal extension code with a small malicious loader placed ahead of it inside the main extension.js bundle. Because it used the genuine anthropic.claude-code identifier, editors that update extensions automatically treated it as an ordinary release.
Cursor pulled the version and briefly took its extension marketplace offline at about 20:35 UTC the same day, The Hacker News reported. A clean 2.1.314 was published early on October 30. Cursor told users the tampered build “was not developed by Anthropic”, that its audits found no other modified extensions in its marketplace, and that it will contact affected users directly. Sophos independently confirmed the timing, the 5,000-user estimate and the attacker’s IP address.
Reports differ on one detail. StepSecurity says the build also passed through Open VSX, the open extension registry that Cursor’s marketplace mirrors, and was later purged there. The Hacker News corrected its own story to say there is no evidence the build reached Open VSX or Microsoft’s Visual Studio Marketplace. Either way, Cursor users were the group exposed. Nobody has yet said publicly how the attacker got publishing access. Stolen publisher credentials are one possibility researchers have raised, but it has not been confirmed.
What the backdoor did
The payload ran as soon as the extension loaded. It did not need you to start a Claude conversation. Based on the analyses from StepSecurity, Sophos and The Hacker News, it:
- Added an attacker-controlled public key, with the comment
svc-telemetry, to~/.ssh/authorized_keys. - Tried to turn on the SSH server. Cursor says this step usually failed on macOS and Windows because it needs admin rights, but the other steps still ran.
- Opened a reverse SSH tunnel to
134.209.82.225, which would let the operator run commands or move files. - Installed persistence: a
SysMonscheduled task on Windows, a LaunchAgent namedcom.apple.sysmondon macOS, and an@rebootcron entry on Linux. - Sent a recon “beacon” over plain HTTP to port 8099. It included your hostname, username, OS, public IP, home and working directories, global Git email, and the names (not the values) of up to 40 environment variables that looked like secrets, such as those containing KEY, TOKEN, AWS or GCP.
No second-stage payload has been reported. Cursor says the command server was taken offline with the hosting provider’s help. But a machine that connected out during the window should be treated as accessible to an outsider for that period.
How to check if you were affected
If you use Cursor with the Claude Code extension and it updated on October 29, run these checks now:
- Look for the key. On macOS or Linux, run
grep svc-telemetry ~/.ssh/authorized_keys. On Windows, open%USERPROFILE%\.ssh\authorized_keysand look for the same label. - Look for persistence. Check for
~/Library/LaunchAgents/com.apple.sysmond.plist, aSysMonscheduled task orsysmon.cmdin your Startup folder,@rebootcron entries, and hidden files such as~/.config/.smtor~/.config/.smtk. - Check the version. Make sure the extension is 2.1.314 or later. Teams can search installed extension folders for
134.209.82.225orsvc-telemetry.
If you find anything, keep a copy of the evidence. Then remove the key and persistence (Cursor has published cleanup scripts for macOS and Windows), update the extension, and rotate every credential that machine could reach: Git hosting tokens, CI/CD secrets, cloud keys, SSH keys and package registry tokens. Do the rotation from a clean machine. If logs show the tunnel actually connected, StepSecurity recommends rebuilding the machine instead of trying to clean it.
Why it matters
This was not a typosquat that relied on someone installing “claude-c0de” by mistake. It was a poisoned update to one of the most popular AI developer tools, delivered through the normal update channel. Developer laptops are high-value targets: they hold source code, cloud credentials and signing keys, and they can usually reach production systems. AI coding tools make this worse, because they work with broad file and terminal access by design.
It also exposes a weak point in the VS Code fork ecosystem. Editors such as Cursor can’t use Microsoft’s official marketplace, so they depend on Open VSX and their own mirrors, which come with different publishing and review controls. Each extra distribution channel is another place a trusted name can be hijacked. We’ve covered the wider pattern of AI speeding up both bug-hunting and attacks. This incident shows the supply chain behind AI tools is now a target too.
What it means for developers and teams
For individual developers, the main lesson is that auto-updating extensions is a trust decision. You are trusting the publisher, the registry and every account that can push to it. If you choose between tools on security as well as features (see our Claude Code vs Cursor comparison), how each one distributes updates now belongs on that list. Running the Claude Code CLI installed from Anthropic’s own channel is a different supply chain from an extension mirrored through a third-party marketplace.
For engineering and security teams, there are some practical steps. Keep an inventory of which editors and extensions run on company machines. Consider pinning extension versions or delaying updates by a day or two for critical tools. Alert on new entries in authorized_keys and on new LaunchAgents or scheduled tasks. And use short-lived credentials so that a stolen token stops working quickly.
What to watch next
The biggest open question is how version 2.1.313 got published under Anthropic’s extension ID. Anthropic had not issued its own detailed statement in the reports we reviewed. Watch for a root-cause report from Cursor or Anthropic, any changes to Open VSX publishing controls, such as stricter namespace verification or signed releases, and whether security vendors find signs that the tunnel was used for follow-up attacks. If you were affected, Cursor says it will contact you directly. Don’t wait for that email before checking your machine.