Malicious Claude Code Extension Affects Up to 5,000 Cursor Users

Cursor has disclosed a security incident involving malicious versions of Anthropic’s Claude Code extension that attempted to install a persistent backdoor on developers’ computers. The company initially estimated that up to 5,000 users could have been affected, highlighting the security risks associated with compromised software development tools.

The compromised extension packages, identified as Anthropic.claude-code versions 2.1.312 and 2.1.313, were distributed through Cursor’s VS Code extension marketplace during an approximately 11-hour window on October 29, 2026, from 2:27 a.m. to 1:35 p.m. Pacific Time.

Cursor said the malicious software was not created by Anthropic and that it found no evidence that other versions of Claude Code were compromised.

The attack targeted developers’ workstations, which frequently have access to software repositories, cloud platforms and credentials used to build and deploy applications.

Backdoor Aims for Persistent Access

The malicious code attempted to establish remote access through Secure Shell (SSH), a protocol commonly used by developers and IT administrators to connect to remote systems.

Security researchers at Phorion found that the compromised extension attempted to insert an attacker-controlled SSH key into the computer’s authorized keys file. This could allow an unauthorized user to access the machine remotely. The malware also attempted to create an outbound SSH connection to an attacker-controlled server. To maintain access, it installed background processes designed to restart after a computer reboot.

On Windows, the malware attempted to establish persistence through a scheduled task. On macOS, it used a LaunchAgent, while the malware also contained code targeting Linux systems through a cron entry. The software was programmed to retry its remote connection approximately every 60 seconds.

Beyond remote access, the malware collected information about the targeted computer, including its operating system, username, Git email address and public IP address.

Researchers also identified code that collected the names of up to 40 environment variables associated with passwords, API tokens and cloud credentials, including those used by AWS and Google Cloud. The malware’s initial reporting mechanism did not transmit the credential values themselves. But the information could help attackers identify computers containing valuable company resources.

Despite the malware’s capabilities, programming errors apparently prevented some of its most damaging functions from operating on many computers. Cursor said the attack generally required administrator privileges to activate the local SSH service, which the malicious extension typically lacked on macOS and Windows machines.

Phorion found that a faulty permissions check on macOS could prevent the malware from enabling remote login. But machines with SSH already enabled could remain vulnerable because the attacker’s key had been installed. This matters because a failed remote connection doesn’t necessarily mean a computer is free of malicious software.

Cursor Removes Extension, Advises Cleanup

Following the discovery, Cursor removed the compromised packages and temporarily closed its extension marketplace. The company subsequently audited marketplace access, replaced security keys and rebuilt the marketplace before restoring service.

Cursor also coordinated with the hosting provider of the attacker’s server to disable the infrastructure supporting the attack. But for affected developers, removing the extension alone may not eliminate the threat.

Cursor recommends checking for an unauthorized SSH key labeled svc-telemetry, removing malicious background processes and changing credentials accessible from affected computers. Companies should also consider isolating compromised machines and rebuilding systems where necessary.