Cursor's Marketplace Served a Backdoored Claude Code Build for About 11 Hours. Anthropic's Own Channels Show No Version 2.1.313.

On Thursday, October 29, 2026, Cursor posted a security notice that every developer with an AI coding extension should read. A maliciously modified build of Anthropic's Claude Code extension, labeled version 2.1.313, was available in the Cursor VS Code extension Marketplace from about 2:27am to 1:35pm Pacific time. That is a window of roughly 11 hours.

The build tried to install a persistent SSH backdoor. Cursor is explicit about Anthropic's role: "This malicious version of the extension was not developed by Anthropic." Its count of victims is a ceiling, not a number: "At most 5,000 users were affected, and we will reach out directly."

We checked the places Anthropic actually publishes. None of them lists a 2.1.313. The fake took the next unused version number, and on a product that ships close to daily, that was enough to look routine.

What the Build Did

Cursor's notice and researchers quoted by The Hacker News and Help Net Security describe the same chain. Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News the main JavaScript bundle carried a 66-line malicious loader placed before the legitimate code. Calum Hall, CEO of the macOS security firm Phorion, told Help Net Security the code runs when Node loads the file, before the extension's normal activation, with no user interaction.

• It added an attacker SSH key, labeled svc-telemetry, to the user's authorized keys file.
• It tried to switch on the local SSH service and open a reverse tunnel to 134.209.82.225, retrying about every 60 seconds.
• It installed persistence: a LaunchAgent on macOS, a scheduled task named SysMon on Windows with a Startup folder fallback, and, according to the researchers, a reboot cron entry on Linux.
• It sent host details over plain HTTP to port 8099: hostname, username, OS, architecture, home and working directories, Git email and public IP. The Hacker News reports it also sent the names, not the values, of up to 40 environment variables that look like keys, tokens or cloud credentials.

There is one piece of good news in the notice. Turning on SSH needs administrator rights, which the extension does not have on most macOS and Windows machines. "On those hosts the step fails and the attacker could not have logged in through the tunnel," Cursor writes. It still says remediation is needed, because the key, the persistence and the beacon land either way. Hall's read is the one to keep in mind: "The goal of this payload is long-term interactive access." If Remote Login is already on, or gets turned on later, the door is there.

The Version Number Nobody Else Published

Anthropic ships the same extension and CLI through several channels. We pulled the version records from each on Friday morning. Times are UTC; the Cursor window converts from Cursor's Pacific times.

Sources: npm registry, Open VSX, Visual Studio Marketplace, Claude Code changelog, Cursor. Download and install counts are each store's own totals as of October 30.

Two things jump out. First, the cadence: Anthropic pushed 13 releases to npm from October 14 to October 27, from 2.1.300 to 2.1.312. A 2.1.313 two days after the last one is exactly what an auto-updating user would expect to see. Gile told The Hacker News the build "was pulled very quickly," then added: "but anyone who has their Claude Code instance set to auto-update could have consumed the malware," a risk Cursor's notice does not address.

Second, Anthropic's next build skipped the number. Version 2.1.314 landed on npm at 00:12 UTC on October 30, which is 5:12pm Pacific on October 29, about three and a half hours after Cursor's window closed. We do not know why Anthropic skipped 2.1.313, and it has not said. Its changelog goes straight from 2.1.312 to 2.1.314, and we found no public Anthropic statement on the incident.

Early coverage blamed Open VSX, the Eclipse Foundation's registry. The Hacker News has since corrected that and traced the build to Cursor's own marketplace, with no evidence it reached Open VSX or Microsoft's store. Our own check of Open VSX matches the correction.

What Cursor Did, and What It Has Not Said

Cursor deserves credit for the response. It pulled the version, shut its VS Code marketplace down as a precaution, audited access and says no other extensions were tampered with. "We rotated our keys, rebuilt the marketplace, and brought it back online," it wrote. It worked with the hosting provider to take the attacker server offline, and it published hashes, IPs, key fingerprints, file paths and cleanup scripts for macOS and Windows the same day. That is a better notice than most vendors manage in a week.

What the notice does not contain is the cause. Cursor does not say how a modified build got into its store under Anthropic's extension ID. Rotating keys suggests the team suspected its signing or publishing path, but that is our inference, not Cursor's statement. The Hacker News writes that the exact method "remains unclear."

Ownership adds an awkward layer. SpaceX completed its $60 billion purchase of Cursor on August 14, according to VKTR, and Cursor now sits inside SpaceXAI, the division that also runs Grok. So a store owned by Grok's parent distributed a poisoned build of a rival lab's flagship tool. We see no sign that was anything but an attack on the store. It does mean Anthropic's users depended on a competitor's infrastructure without most of them thinking about it.

Our Take

The extension carried Anthropic's name, Anthropic's ID and the next plausible version number. None of that came from Anthropic. The store decided what got installed, and the user had no independent way to check the build against what the publisher actually shipped. That is the real lesson, and it is not about Cursor alone. In our view, any editor that installs from its own copy of a publisher's extension carries the same exposure.

Ax Sharma of Manifold Security made the point that will age best: "Increasingly, it's agents and automatic updates installing these things, not humans." A coding extension sits next to SSH keys, cloud credentials and source code. An auto-update that silently swaps it is about as privileged a delivery path as exists on a developer laptop. When we covered Plugin4Shell in September, the weak point was a pin that was checked as declared rather than as fetched. This time it was a store whose copy did not match the publisher's. Same lesson, different layer: trust the artifact, not the label.

At most 5,000 users is small next to the 29 million installs on Microsoft's marketplace. It is still 5,000 machines that may carry an attacker's key. If you use Cursor, run its impact check now. Search your authorized keys for svc-telemetry, remove the persistence, and rotate any credentials that machine could reach. Uninstalling the extension is not enough. Cursor says the payload "drops standalone persistence scripts that keep running."

Three things we will watch over the next 60 days. Whether Cursor publishes a root cause for how the build entered its store. Whether Anthropic says anything about the incident, or about how users should verify its builds outside its own channels. And whether any VS Code fork starts checking extensions against the publisher's own release before installing them.

Sources: Cursor security notice, The Hacker News, Help Net Security, Unite.AI, Claude Code changelog, VKTR.