A Fake Claude Code Extension Backdoored Cursor Users

A malicious version of Anthropic's Claude Code extension was available in Cursor's VS Code extension Marketplace for about 11 hours on 29 Oct 2026, and Cursor says at most 5,000 users were affected (Cursor security notice). The package, Anthropic.claude-code version 2.1.313, was not developed by Anthropic (Cursor security notice). If you installed or updated it that day, the first check is simple: look for an SSH key labelled svc-telemetry in your authorized_keys file, then work through the removal steps before you trust the machine again.

TL;DR

• A tampered Anthropic.claude-code 2.1.313 sat in the Cursor Marketplace from about 2:27am to 1:35pm PT on 29 Oct 2026.
• It collected host and user details, added an attacker SSH key, tried to enable SSH and open a reverse tunnel, and installed persistence.
• Enabling SSH usually failed for lack of admin rights, but the extension still added the key, installed persistence and sent host details.
• Cursor removed the version, audited the marketplace, rotated keys and restored it; it found no other tampered extensions.
• Uninstalling is not enough. Remove the key, the persistence and the tunnel, then rotate credentials from a clean system.

Disclosure: ZeroRaised publishes this analysis and is a launch site for bootstrapped products. Facts come from the linked sources as checked on 30 Oct 2026; ZeroRaised has no commercial relationship with the companies named.

IDE extension supply chain attack is an attack in which someone publishes or tampers with an editor extension so that installing it runs code with the developer's own permissions.

What happened to the Claude Code extension in Cursor?#

The malicious build was available between about 2:27am PT and 1:35pm PT on 29 Oct 2026 (Cursor security notice). Cursor removed the version, shut the marketplace down as a precaution, audited access and found no other tampered extensions, rotated keys, rebuilt and restored the marketplace, and got the attacker server taken offline (Cursor security notice). Cursor says it has no evidence that other versions or the official distribution were affected (Cursor security notice).

Eleven hours was long enough for up to 5,000 users to pick it up. An extension update rarely gets a second look before you reload and get back to work.

What did the malicious extension actually do?#

According to Cursor, the extension collected host and user information: hostname, username, operating system, architecture, home directory path, the names of environment variables, working directories, the configured Git email and the public IP (Cursor security notice). It then tried to add an attacker SSH key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel (Cursor security notice). It also set up persistence, with a LaunchAgent on macOS and a scheduled task on Windows, retrying roughly every 60 seconds, and it reported host details to the attacker (Cursor security notice).

Notice what was taken: not just tokens, but a map of the machine, its people and its projects. Environment variable names alone can hint at which cloud, database and payment stack a team depends on.

Why did the SSH backdoor still matter if it failed?#

Enabling SSH needs admin rights that the extension lacked on most macOS and Windows hosts, so that step usually failed (Cursor security notice). It still added the key, installed persistence and sent host details (Cursor security notice).

This is the failure mode founders misread. "The backdoor did not work" is not the same as "nothing happened". A planted key is a standing invitation that survives a reboot. A scheduled task is a re-entry point. Host details are reconnaissance that makes a later, more targeted attempt cheaper. Treat the incident as a credential compromise, not as a failed exploit.

How do you check whether you were affected?#

Cursor's own advice is specific. Look for the key labelled svc-telemetry in ~/.ssh/authorized_keys, isolate affected hosts, and remove the key, the persistence and the tunnel processes using Cursor's remediation scripts (Cursor security notice). Cursor adds that uninstalling the extension may not be sufficient, and that you should rotate credentials and sessions from a trusted system (Cursor security notice).

Do the rotation from a different machine; if the host has a persistence mechanism you have not found, changing passwords from it hands the new credentials back. The API key rotation guide covers the order, and the vibe-coded app security checklist is a useful sweep.

What should a founder change about extensions?#

Start with the boring controls. Pin extension versions where your editor allows it, and read the changelog before you accept a jump. Prefer publishers you can identify. Keep production secrets out of the editor's home directory, so a compromised extension does not inherit the keys to your infrastructure. If an extension asks for broad filesystem or shell access, ask whether the feature justifies it.

The same logic applies to agents. The guide to sandboxing an AI agent explains how to bound what a tool can reach, and the prompt injection guide covers untrusted content steering a model. An extension that can read your notes and run a command is an agent with your permissions.

If you ship an extension, your users are trusting your update channel. The VS Code extension publishing guide covers the mechanics; the trust part is editorial: keep a short release history and never ask for more access than the feature needs.

What this means for bootstrapped founders#

• Assume one laptop holds too much. Split production credentials from the machine you install tools on, or use short-lived credentials that expire faster than a breach is noticed.
• Make rotation a rehearsed step. If revoking keys takes an afternoon of guessing, it will happen late. Write the list down now.
• Pin and review. A version pin is not paranoia when the alternative is an automatic update from an account you do not control.
• Check the blast radius, not just the package. The extension was one file. The exposure is every key, session and repository the developer could reach.
• Tell customers plainly if you were affected. "We isolated the host, rotated credentials and found no unauthorised access" beats silence, and it is the kind of answer buyers remember.

This was a supply chain problem dressed as a normal update, and it worked because normal updates are supposed to be invisible.

Where ZeroRaised fits#

ZeroRaised is a launch and discovery site for products built without institutional venture capital or accelerator equity. If you have a product people can try, submit your product; the pricing page explains the current options. A launch page is a good place to state plainly how you handle security and what you would do if something went wrong.

For more practical analysis, join the ZeroRaised newsletter. No promises of traffic or results, just the useful parts.

Sources#

• Cursor: Claude Code extension security notice