Fake Claude Code update in Cursor's marketplace tried to plant an SSH backdoor key, up to 5,000 users hit

The most trusted name in AI coding was the bait. For about 11 hours on Oct. 29, 2026, a maliciously modified version of Anthropic's Claude Code extension, Anthropic.claude-code 2.1.313, was available in the Cursor VS Code extension marketplace, Cursor said in a security notice.

"This malicious version of the extension was not developed by Anthropic," Cursor wrote. "At most 5,000 users were affected, and we will reach out directly." The Verge, citing Reuters, put the exposure window at 5:27 a.m. to 4:35 p.m. ET.

What the fake build did

According to Cursor, the code:

• collected hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email and public IP;
• tried to add an attacker-controlled SSH key, labeled svc-telemetry, to authorized_keys, enable the local SSH service and open a reverse SSH tunnel;
• tried to make the tunnel persistent via a LaunchAgent on macOS or a scheduled task on Windows, with background scripts retrying roughly every 60 seconds;
• reported host details to the attacker via HTTP POST.

Why most victims got lucky

Turning on the local SSH service requires admin rights, which the extension does not have on most macOS and Windows hosts, Cursor said. On those hosts that step fails and the attacker could not have logged in through the tunnel. Sophos X-Ops, citing analysis by Phorion, likewise said that due to coding errors SSH enablement fails on most macOS and Windows hosts.

But the extension still adds the attacker's key, installs persistence and sends host details. Cursor says the attacker server no longer functions after it worked with the hosting provider to take it offline.

What Cursor did, and what users must do

Cursor says it removed the version, blocked further distribution, shut down the marketplace, audited access and "confirmed no other extensions were tampered with", rotated its keys, rebuilt the marketplace and brought it back online. It has no evidence other versions or the official distribution are affected.

Anyone who installed or updated to 2.1.313 in the window should check authorized_keys for the svc-telemetry key, isolate affected hosts, run Cursor's remediation scripts and rotate credentials from a trusted system. "Uninstalling the extension may not be sufficient," Cursor warned, because the payload drops standalone persistence scripts. Sophos put it more bluntly: uninstalling leaves the backdoor in place.