Cursor removed a compromised Claude Code extension from its marketplace on October 29 after researchers found that malicious versions of the plug-in had installed an SSH backdoor. An estimated 5,000 users may have been affected. The issue did not involve Anthropic's AI model, Claude; instead, the malware reached developers through Cursor's extension marketplace.

Two poisoned builds slipped in for eleven hours

Two compromised versions of Anthropic.claude-code — 2.1.312 and 2.1.313 — were made available for download on Cursor's marketplace for Windows and macOS. According to Cursor's notice, they remained available for about eleven hours on October 29, from 2:27 a.m. to 1:35 p.m. Pacific time.

Anthropic did not create either malicious plug-in. OpenSourceMalware, which examined version 2.1.313, found that the official npm package, the Open VSX listing, and the Microsoft VS Code Marketplace version were unaffected. That distinction places the compromise in Cursor's distribution channel rather than in the extension itself — the defining feature of a supply-chain attack, where the trusted path for installing software becomes the attack vector.

A backdoor prepended before the real extension

The attacker hid a 66-line loader at the start of the extension's JavaScript file, meaning the malicious code ran before the legitimate extension. As OpenSourceMalware explained:

"The user doesn't need to begin a Claude conversation. Loading the extension module is enough."

Upon activation, the code collected information about the computer along with the types of credentials present on it — an inventory step that matters because developer machines often hold access to source repositories, cloud infrastructure, and deployment pipelines. It also generated an SSH key named svc-telemetry and attempted to create a reverse tunnel to 134.209.82.225, while simultaneously sending device data via HTTP on port 8099.

Cursor said attempts to use SSH typically failed without admin privileges. Even so, the spyware key and persistence scripts can remain on the computer, and the code could continue gathering and transmitting information about the machine.

Why uninstalling may not be enough

Cursor removed the malware, temporarily shut down its marketplace, checked other extensions, and worked with the hosting provider to take the attacker's server offline. That did not mean affected computers were safe. Cursor warned in its security guidance:

"Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running."

Examples of those persistence scripts are a LaunchAgent on macOS and a scheduled task on Windows. Cursor advised affected developers to delete the svc-telemetry SSH key and to run the company's cleanup scripts. Developers must use a separate, trusted device to change any credentials accessible from the affected computer. Anyone who installed the affected versions should confirm those artifacts are gone even after uninstalling the extension.

Why this fits a 2026 pattern

The Cursor incident is part of a bigger problem: attackers are increasingly targeting the tools developers use and trust. The Cloud Security Alliance reported on the TrapDoor campaign, which involved more than 34 malicious packages that inserted hidden instructions into AI-assistant configuration files. Meanwhile, the GlassWorm campaign used sleeper extensions to target developers' credentials and crypto wallets; Cryptopolitan previously reported on the 73 such extensions identified by Socket. What sets the Cursor case apart is the location: the compromised builds appeared on the marketplace operated by the tool vendor itself, rather than in a third-party listing.

The problem goes beyond extensions. Sonatype identified more than 454,600 new malicious packages in 2025 — findings Cryptopolitan also covered regarding poisoned npm libraries. These were separate attacks, with no confirmed links between their perpetrators.

Trust becomes a line item in enterprise contracts

The growing threat is evident as developers' use of AI tools increases. GitHub's Octoverse says developer activity has risen as AI systems gain popularity. In the 2026 Stack Overflow survey, 80% of respondents said they use AI tools for an hour per day or more, while 48% said they trust AI-generated content only if its validity is easy to confirm.

For businesses, the growing use of AI tools brings new security concerns. Companies may start demanding stronger marketplace checks, proof that extensions come from legitimate sources, and tighter access controls. They may also expect vendors to respond faster when security breaches occur. These security measures could be yet another cost of implementing AI tools — though these costs remain potential rather than actual financial losses from the Cursor incident.

Source: Cryptopolitan