Cursor removes tampered Claude Code extension after backdoor attempt

Cursor removed malicious versions 2.1.312 and 2.1.313 of Anthropic’s Claude Code extension after they were available in its marketplace for approximately 11 hours on October 29. Targeting Windows and macOS, the modified extension attempted to plant an attacker-controlled SSH key, enable local SSH access, and establish a reverse tunnel to an attacker-controlled server. Anthropic said the attacker used access to Cursor’s marketplace, not compromised Anthropic systems or employee laptops. Official distribution channels were unaffected.

Security company Phorion found that the payload ran as soon as the extension loaded, without user interaction. It created scripts and startup entries intended to maintain access after a restart. Implementation errors and administrator-privilege requirements could prevent SSH setup, but the malware could still plant keys, install persistence mechanisms, and transmit host information. Microsoft found that it collected system and developer details alongside matching environment-variable names, not their values.

Cursor warned that removing the extension might not eliminate malicious components stored outside its installation directory. Security researchers recommended checking authorized SSH keys and their fingerprints, rotating potentially exposed credentials, and reviewing login logs. Cursor temporarily shut down its marketplace, audited access, rotated keys, and rebuilt the service before restoring it. The incident also prompted calls for stronger publisher verification, package-integrity checks, extension allowlisting, and controlled updates.