Cursor marketplace served a tampered Claude Code extension

TL;DR: On October 29, 2026, a tampered copy of Anthropic's Claude Code extension sat in the Cursor extension marketplace for about 11 hours. Cursor says at most 5,000 users were affected, that the attacker's server has been taken down, and that Grok Bot, Grok and its other products were not touched. If you installed or updated that extension on macOS or Windows that day, check for one SSH key and follow Cursor's cleanup steps.

What Cursor says happened

Cursor said it found a malicious version of the Anthropic.claude-code extension in its marketplace. The affected versions are 2.1.312 and 2.1.313 for Windows and macOS. Cursor says they were not built by Anthropic.

Per Cursor, the bad version was available from about 2:27 AM to 1:35 PM Pacific time on October 29, 2026. That is a little over 11 hours. Cursor's own count is "at most 5,000 users."

Cursor's notice says the code tried to do three things:

• Collect host details such as hostname, username, operating system, home directory path, environment variable names, configured Git email and public IP.
• Add an attacker's SSH key to the machine's authorized_keys file, turn on the local SSH service and open a reverse SSH tunnel.
• Make the tunnel survive restarts, using a LaunchAgent on macOS or a scheduled task on Windows.

Cursor adds that the tunnel step would fail on most machines, because enabling the SSH service needs admin rights that the extension does not normally have. It also says the key, the persistence scripts and the host details were still written or sent, so everyone who installed it should follow the cleanup steps.

What Cursor did about it

Cursor says it removed the bad version right away, then shut down the whole marketplace as a precaution. It reports that it audited access, found no other tampered extensions, rotated its keys, rebuilt the marketplace and reopened it. It also says it worked with the hosting provider to take the attacker's server offline.

Cursor's post on X the next morning put it this way: the version "was not developed by Anthropic" and does not affect other marketplace extensions. Its notice also says Grok Bot, Grok and its other SpaceXSI products were not affected.

Who else weighed in

• Microsoft's security team analyzed the code and reported that the packages were never published to the Visual Studio Marketplace or to npm, and that all evidence points to the incident being limited to Cursor's marketplace.
• Anthropic told Microsoft its systems were not compromised, per Microsoft's write-up.
• WIRED reported that an Anthropic staff member said on X that a malicious actor used access to Cursor's marketplace to publish the tampered copy. How the attacker got that access is still unclear in the reports we read.

What to check

Only the two versions above, installed or updated from the Cursor marketplace on October 29 between those times, are in scope. Cursor says to look for a key labeled svc-telemetry in your SSH authorized_keys file. If you find it, treat the machine as affected:

1. Isolate the machine.
2. Remove the unauthorized key, the persistence scripts and any running tunnel processes. Cursor warns that simply uninstalling the extension may not be enough.
3. Run Cursor's remediation script for your platform.
4. Rotate credentials and sessions that were reachable from that machine, using a trusted system.

The exact commands, file paths and indicators of compromise are in Cursor's security notice, which Cursor updated on October 30, 2026 at 11:30 AM Pacific to refine the indicators and the list of affected versions. Use that page rather than a copy.

Not confirmed

Reports differ on platform coverage. Cursor's notice names Windows and macOS. WIRED's report also mentions Linux, and Cursor's indicators list Linux file paths. We have not seen Cursor confirm Linux in its affected-platform line, so treat Linux hosts with caution and check them anyway.

Pad Zero SI is an unofficial fan site. Sources are linked below.