A tampered copy of Anthropic’s Claude Code extension was served to developers through Cursor’s extension marketplace on October 29, carrying code designed to give an attacker persistent remote access to their machines. Cursor puts the number of users who may have been exposed at no more than 5,000.

According to Cursor, the malicious build, version 2.1.313, was available from about 02:27 to 13:35 Pacific Time on Thursday, which is 09:27 to 20:35 UTC and roughly 11 hours. Security firm Sophos, which published its own analysis, says Cursor identified affected packages for both macOS and Windows. The endpoint-security vendor Phorion was the first to spot the malicious update, The Register reported.

Technical write-ups describe a loader that added an attacker-controlled SSH key to the victim’s authorised keys, tried to open a reverse SSH tunnel to an outside server, set up persistence, and sent host details such as usernames, Git email addresses and public IP addresses to the attacker. One report adds that the code also collected the names of environment variables containing words such as KEY, TOKEN and SECRET. Persistence is the part that matters most for clean-up: Sophos warns that uninstalling the extension does not remove the backdoor, and The Register reports the same of installing the latest version.

The damage may have been limited by the attacker’s own mistakes. Opening the tunnel needed administrator rights, which the extension often lacked, and Sophos says coding errors meant SSH could not be enabled on most macOS and Windows machines. Even so, the data-collection and key-planting steps could still run.

Anthropic said the incident was not a compromise of its systems. Felix Rieseberg, a member of its technical staff, wrote on X that “it wasn’t a compromise of Anthropic’s systems or employee laptops,” adding: “The versions on our official channels are not affected, and this only impacts Cursor users.” Anthropic’s account is that a malicious actor with access to Cursor’s marketplace published a copy it did not build. Cursor says it removed the malicious version immediately on detection, blocked further distribution, and then shut down its VS Code marketplace “out of an abundance of caution”. It also says it checked that no other extensions were compromised, rotated its own keys before restoring the marketplace and worked with a hosting provider to block the attacker’s server.

Several questions remain open. Cursor has not explained how the malicious package reached its marketplace, and one report notes that how attackers obtained publishing rights under the extension’s identifier is unresolved. The 5,000 figure is Cursor’s upper estimate, not a confirmed count of infections. Reports also differ slightly on affected versions: some name 2.1.313 alone, while another says Cursor’s disclosure also lists 2.1.312, with 2.1.314 as the clean release.

Developers who run Cursor are advised by Sophos to check whether version 2.1.313 was installed during the exposure window, remove the attacker’s SSH key, persistence entries and tunnel processes, and rotate any credentials reachable from affected machines. Cursor’s own advisory carries the full clean-up steps.