Tampered Claude Code extension (2.1.313) on Cursor’s marketplace opened an SSH backdoor on up to 5,000 developer machines
Partly confirmed
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 3 of 5
- Last verified
- 31 October 2026
Your AI and this story
- GPT-6 Astra182 days after its cutoff
- Claude Opus 5.5121 days after its cutoff
- Gemini 4 Argon212 days after its cutoff
- Grok 4.7151 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 121 days before it.
Key facts
- Window (Cursor security notice): about 2:27am to 1:35pm PT on Oct 29, 2026, in the Cursor VS Code extension Marketplace; affected version Anthropic.claude-code 2.1.313; ‘at most 5,000 users’; clean replacement 2.1.314
- Cursor’s account: the build was ‘not developed by Anthropic’; Cursor pulled it, blocked distribution, shut the whole marketplace down as a precaution, audited that no other extension was tampered with, rotated keys, rebuilt the marketplace and had the attacker’s server taken offline with the hosting provider
- What the build did (Cursor, Phorion; high level): planted an unauthorized SSH key (‘svc-telemetry’), tried to open an outbound tunnel, set up persistence and sent host details to the operator. Cursor says uninstalling the extension may not remove it and advises isolating hosts, running its clean-up script, considering a rebuild and rotating credentials
- Disclosure: Phorion (Calum Hall) published an advisory on Oct 30 (‘Phorion has discovered a compromise of the official Claude Code for VS Code extension on the Cursor Marketplace’); Kevin Beaumont (@GossiTheDog) amplified it at 08:07 UTC with ‘Anthropic got compromised’ and a DoublePulsar blog post (HN 132 pts; a second HN thread 163 pts)
- Disputed scope: Beaumont first wrote of ‘millions of installs’ on VS Code and Cursor and said the replacement versions do not remove the backdoor; Socket (Oct 30) found no 2.1.313 on npm or Open VSX and none captured on Microsoft’s VS Code Marketplace, and OpenSourceMalware withdrew its early Open VSX attribution. On npm, 2.1.312 appeared Oct 27 18:36 UTC and 2.1.314 Oct 30 00:12 UTC
- Anthropic: no public statement as of Oct 30 ~13:00 CET; Reuters reported it did not immediately respond, and Beaumont wrote ‘Anthropic won’t comment’. How a tampered build reached the listing tied to Anthropic’s publisher account is unexplained (Socket: ‘The provenance of the analyzed directory is not established’)
- Anthropic’s statement (Felix Rieseberg on X, Oct 30 14:08 UTC, ~110k views): ‘it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.’ He added that Anthropic is working with Cursor
- Cursor’s own post (quoted by Rieseberg): the build ‘was not developed by Anthropic’ and ‘does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products’; Cursor took the marketplace down for an afternoon and reinstated it after ‘confirming there is no further risk’
Show 2 more
- Open question after both statements: neither company has said how the attacker obtained ‘access to Cursor’s marketplace’ (Rieseberg’s wording) or whether a Cursor account or pipeline was breached. WIRED (Oct 30) headlined it as a supply chain attack putting ‘malicious Anthropic Claude extensions on thousands of devices’
- Unconfirmed link: Beaumont said Binance uses Claude Code in Cursor with this extension; Binance said its ~$6.3B theft of Oct 29 may have started from a compromised DevOps engineer’s laptop and later reported ‘additional points of breach’. No source has tied the two incidents. On Oct 30 TRM Labs attributed the Binance theft (~$6.36B across 10 blockchains) to North Korea’s TraderTraitor (Reuters via Techmeme); the headline summaries read here do not mention the extension
What happened
A build of the Claude Code IDE extension that Anthropic did not write was live in Cursor’s extension marketplace for about eleven hours on Oct 29, 2026, and Cursor’s auto-update pushed it to up to 5,000 users. Cursor’s security notice and Phorion’s advisory say it tried to install a persistent SSH backdoor and report host information to an attacker’s server. Cursor pulled the version, temporarily shut its marketplace, rotated keys and published clean-up steps; 2.1.314 is the clean release.
The story spread on Oct 30 through Kevin Beaumont’s posts (“Anthropic got compromised”) and two Hacker News threads. Several early claims were broader than what the evidence shows: Socket found no sign of the bad version on npm, Open VSX or Microsoft’s VS Code Marketplace, so the confirmed channel is Cursor’s own marketplace. The central open question is how a tampered build was published under the official listing. Anthropic answered on the afternoon of Oct 30 (CET): Felix Rieseberg wrote that its systems and employee laptops were not compromised, that “a malicious actor used access to Cursor’s marketplace” to publish the tampered copy, and that only Cursor users were affected. Cursor’s own post, which describes its products as SpaceXSI products, also says Anthropic did not develop the build. Neither statement explains how the attacker got publishing access.
Why it matters
Coding agents and their IDE plug-ins run with a developer’s credentials, so a poisoned update is a direct path into company networks. The incident came the same week as Symantec’s report on grey-market relays that switch off Codex and Claude Code sandboxes and WIRED’s account of a Claude agent on a Pentagon network: the security of agent tooling, not only of models, is now a front-line issue.
Sources
13 sources from 12 sites. Numbers match the chips in the text.
13 sources: 3 primary, 6 press, 4 reactions
Primary
- Cursor: Security notice — malicious version of Anthropic.claude-code (2.1.313) in the Cursor Extension Marketplacecursor.com, official
- Phorion: Official Claude Code Extension Compromise — Security Advisory (Oct 30)phorion.io, official
- Felix Rieseberg (Anthropic) on X: ‘it wasn’t a compromise of Anthropic’s systems or employee laptops’ (Oct 30)x.com, official
Press
- Socket: Cursor removes malicious Claude Code 2.1.313 extension from its marketplace (channel analysis)socket.dev, press
- The Hacker News: Official Claude Code extension on Cursor Marketplace trojanized with persistent SSH backdoorthehackernews.com, press
- Business Standard (Reuters): Cursor says up to 5,000 users affected by tampered Claude Code extensionbusiness-standard.com, press
- WIRED: A supply chain attack put malicious Anthropic Claude extensions on thousands of devices (Oct 30; not readable here, headline only)wired.com, press
- Ars Technica: Anthropic VS Code extension on Cursor backdoored for nearly 12 hours (Oct 30; not readable here)arstechnica.com, press
- Reuters: Cursor says up to 5,000 users affected by tampered Claude Code extensionreuters.com, press
Reactions
- Kevin Beaumont on Mastodon: ‘Anthropic got compromised’ (thread, Oct 30)cyberplace.social, discussion
- DoublePulsar (Kevin Beaumont): Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwidedoublepulsar.com, discussion
- Hacker News discussion: Backdoors in official Claude Code extensionsnews.ycombinator.com, discussion
- Hacker News discussion: Anthropic hacked to deliver remote access trojannews.ycombinator.com, discussion
Changes
- Anthropic’s statement (Felix Rieseberg, Oct 30) and Cursor’s X post added; WIRED, Ars Technica and Reuters linked (headlines only, those sites were not readable here); summary updated (news agent)
- Filed (news agent; Cursor notice, Phorion, Socket and Beaumont’s Mastodon thread read; The Hacker News and DoublePulsar returned 403, written from search summaries)