Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
Oct 30, 2026. If you use Cursor and have the Claude Code extension installed, check this right now. On Oct. 29 Cursor published a security notice saying a malicious, modified version of the Anthropic.claude-code extension, version 2.1.313, was available in the Cursor VS Code extension Marketplace. Cursor says the package was not developed by Anthropic. Every check and fix step below comes from Cursor's notice; use the official page, not copies.
Official notice: https://cursor.com/blog/claude-code-extension-security-notice
Who is affected
According to Cursor, the malicious version was available between about 2:27 a.m. and 1:35 p.m. PT on Oct. 29, 2026 (5:27 a.m. to 4:35 p.m. ET). You are in scope if you installed or updated to Anthropic.claude-code 2.1.313 from the Cursor marketplace in that window. Cursor says at most 5,000 users were affected and that it will contact them directly.
Cursor says it has no evidence that other versions of the extension, or Anthropic's official distribution, are affected.
What the malicious version tried to do
In plain terms, Cursor says the tampered extension:
- collected basic host and user information (hostname, username, OS, home folder path, environment variable names, Git email, public IP) and tried to send it to an attacker server;
- tried to add an attacker-controlled SSH key to your machine and open a remote-access tunnel;
- tried to keep that access in place after a restart (a LaunchAgent on macOS, a scheduled task or Startup script on Windows).
Cursor adds two reassuring points. The attacker's server has been taken offline with the hosting provider's help. And on most macOS and Windows machines, turning on the local SSH service needs admin rights the extension did not have, so that step would have failed and the attacker could not have logged in through the tunnel. The notice is clear, though, that the key, the persistence and the host-details report can still be present, so you should follow the fix steps regardless.
We don't repeat file paths, network indicators or commands here; security teams should take them from Cursor's notice.
How to check
Cursor's notice gives a one-line check for macOS and one for Windows PowerShell. Both look for the attacker's SSH key in your SSH authorized-keys file(s). Copy them only from the official page.
- Key found: your machine is affected. Go to the fix steps.
- No key found: Cursor's check reports the machine as not impacted.
How to fix
Cursor's recommended steps, summarized:
- Run the official check above.
- Teams: search endpoint, network and extension-install telemetry for the indicators listed in the notice.
- Isolate any machine that shows signs the payload ran.
- Run Cursor's remediation script for your platform. Download it from the notice; on macOS run it as your normal user, not root, and on Windows from an Administrator PowerShell. Cursor says the scripts remove the extension, the persistence, running tunnel processes and the attacker key, and exit with an error if anything remains. Then decide whether to rebuild the machine.
- Rotate credentials and sessions reachable from that machine, working from a different, trusted computer. Cursor notes the limited environment-variable collection does not rule out later credential access over the backdoor.
Uninstalling the extension does NOT remove the backdoor
Cursor writes that "uninstalling the extension may not be sufficient": the payload drops standalone persistence scripts that keep running. Removing 2.1.313 from your extensions list is not a fix on its own.
What Cursor says it did
Cursor says it pulled the malicious version as soon as it was detected, then shut down the whole VS Code Marketplace as a precaution. It audited access and found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back online, and worked with the hosting provider to take the attacker's server down.
What's confirmed / not confirmed
Confirmed (Cursor security notice, Oct. 29, 2026, read Oct. 30): - Malicious Anthropic.claude-code 2.1.313 in the Cursor VS Code extension Marketplace, not built by Anthropic. - Window: about 2:27 a.m. to 1:35 p.m. PT, Oct. 29; at most 5,000 users affected. - Attacker server offline; SSH-enable step fails without admin rights on most macOS/Windows hosts. - Uninstalling may not be enough; use the official check and remediation scripts.
Not confirmed / not covered here: - How the package got into the marketplace. Cursor's notice does not say. - Whether any affected machine was actually accessed. Cursor says the tunnel step usually failed but tells everyone to remediate anyway. - Whether Anthropic has published its own statement. We did not find or check one this run. - Third-party write-ups (Phorion, Mastodon, X) were not used.
Related
Up: AI