What happened
Cursor says that malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension, for Windows and macOS, were available in the Cursor VS Code Extension Marketplace from about 2:27 am to 1:35 pm Pacific time on October 29, 2026. The versions were not built by Anthropic. Cursor first published its notice that day and updated it on October 30.
According to Cursor, the payload collected host details such as hostname, user name, operating system, environment variable names, the git email and the public IP address. It then added an SSH key labelled svc-telemetry, tried to enable SSH and opened a reverse tunnel to a server at 134.209.82.225; Cursor says the tunnel step fails without administrator rights. It persisted as a LaunchAgent named com.apple.sysmond on macOS and as a SysMon scheduled task or Startup script on Windows. Phorion, the EDR vendor that first spotted it according to The Register, also found Linux code paths in the loader.
What Cursor and Anthropic have said
Cursor removed the versions, shut down and rebuilt its marketplace, rotated keys and says it audited that no other extensions were tampered with. It reports the attacker's server is offline. Cursor's notice does not give the number of affected users, and neither company has explained how the attacker got publishing access. The Register reported the same gap.
Anthropic has published no official statement or advisory page as of October 31. The only Anthropic response we found is from Felix Rieseberg of Anthropic's technical staff on X and Hacker News, saying it was not a compromise of Anthropic's systems or employee laptops, that a malicious actor used access to Cursor's marketplace to publish a tampered copy Anthropic did not build, and that official channels are unaffected. Microsoft's security blog says Anthropic confirmed to Microsoft that the Visual Studio Marketplace and npm packages were not affected.
What to do if you use Cursor
Check first. On macOS run grep svc-telemetry ~/.ssh/authorized_keys and look for ~/Library/LaunchAgents/com.apple.sysmond.plist; Cursor's notice gives the PowerShell equivalents for Windows. If anything matches, run Cursor's remediate-macos.sh or remediate-windows.ps1 script. Cursor warns that uninstalling the extension alone may not remove the backdoor.
Then treat the machine as exposed: rotate SSH keys, API tokens and cloud credentials that were reachable from it, and review outbound connections to 134.209.82.225. Update the extension to a current version from the marketplace. If your team installs extensions from several marketplaces, pin versions and review automatic updates for coding tools that can run commands.
Go to the source
Sources & further reading
Based on the official documentation below. Features and access can change; check the provider before making a decision.
- Cursor: Security notice on Anthropic.claude-code 2.1.312 and 2.1.313 (opens in a new tab)
- Microsoft Security Blog: Inside a malicious Claude Code-branded extension (opens in a new tab)
- Phorion: Claude Code extension compromise analysis (opens in a new tab)
- Hacker News discussion with Anthropic's comment (opens in a new tab)
- The Register: Anthropic says compromise was not on its side (opens in a new tab)
Was this page useful?
Help us make our coverage more useful. This is feedback on the page, not a rating of the tool.
Go a little further