A tampered copy of the Claude Code extension sat in Cursor’s extension marketplace for about 11 hours on Wednesday, October 29. Anyone who installed it got code that tried to open a hidden SSH backdoor on their computer. Cursor says at most 5,000 users were affected and that it will contact them directly.

The package carried Anthropic’s name and the version number 2.1.313. But Cursor says it “was not developed by Anthropic,” and nothing published so far shows a breach of Anthropic’s own systems or releases. The risk sits with developers who installed or updated the extension inside Cursor that day. It also sits with their employers, whose code and cloud keys live on those laptops.

What Cursor says happened on October 29

Cursor is the AI coding editor that SpaceX finished acquiring on August 14. It runs its own marketplace for Visual Studio Code extensions.

Say Goodbye to Debt and Become Rich, Just Carry Them in Your Wallet

say goodbye to debt and become rich, just carry them in your wallet...

October 30, 2026

12:00 pm

Hair grows 2 cm per day! Just do this

hair grows 2 cm per day! just do this...

October 30, 2026

11:59 am

This Simple Trick Removes All Parasites From Your Body!

this simple trick removes all parasites from your body!...

October 30, 2026

11:54 am

A spoon on an empty stomach burns 26 lbs in a week

a spoon on an empty stomach burns 26 lbs in a week...

October 30, 2026

12:04 pm

Its security notice, posted the same day, names the package as Anthropic.claude-code 2.1.313. It was available from about 2:27 a.m. to 1:35 p.m. Pacific time.

Cursor said it removed the package and blocked further downloads. It also took the whole marketplace offline, rotated keys, rebuilt the marketplace and brought it back.

The company worked with the hosting provider to take the attacker’s server down. Its audit found no other tampered extensions. It says it has “no evidence” that other versions or the official distribution are affected.

This product is putting plastic surgeons out of work

this product is putting plastic surgeons out of work...

October 30, 2026

12:10 pm

I did this and my knees and joints haven’t hurt for 10 years now.

i did this and my knees and joints haven’t hurt for 10 years now....

October 30, 2026

12:08 pm

Varicose Veins Disappear As if They Never Happened! Use It Before Bed

varicose veins disappear as if they never happened! use it before bed...

October 30, 2026

12:01 pm

Doctor: Іf You Have Nail Fungus, Do This Immediately

doctor: Іf you have nail fungus, do this immediately...

October 30, 2026

11:49 am

Nobody has said publicly how the package got into the marketplace. Cursor told the research group OpenSourceMalware that the compromise started in Cursor’s own marketplace, “not Open-VSX.”

Open VSX is the community registry that many VS Code-style editors draw from. A HOL Guard incident page notes a different account from the supply-chain firm StepSecurity. It says the version went to Open VSX first and Cursor copied it. Either way, the Cursor copy is the only one known to have reached users.

The code ran as soon as the editor started

According to OpenSourceMalware’s analysis, the attacker added a 66-line loader to the top of the extension’s main file. It ran when the editor started and when the extension’s panel opened. A user didn’t have to talk to Claude for it to fire.

If You Find Moles or Skin Tags on Your Body, Read About This Remedy. Genius!

if you find moles or skin tags on your body, read about this remedy. genius!...

October 30, 2026

12:06 pm

After Reading This, You Will Be Rich in 7 Days. Simple trick

after reading this, you will be rich in 7 days. simple trick...

October 30, 2026

12:01 pm

Hair Will Grow Back! No Matter How Severe the Baldness

hair will grow back! no matter how severe the baldness...

October 30, 2026

12:05 pm

4 Signs Telling That Parasites Are Living Inside Your Body

4 signs telling that parasites are living inside your body...

October 30, 2026

11:58 am

The loader first gathered details about the machine. Cursor lists the hostname, username, operating system and home directory. It also took working directories, the Git email address, the public IP address and the names of environment variables. All of it went to an attacker server on port 8099.

Next it tried to give the attacker a way back in. It added an SSH key labeled svc-telemetry to the user’s authorized_keys file. Then it tried to switch on the computer’s SSH service and open a reverse tunnel to the attacker. Background scripts retried that link about every 60 seconds.

To survive a reboot, it set up a LaunchAgent on macOS and a scheduled task or Startup script on Windows. OpenSourceMalware says it also tried a crontab entry on Linux.

Lose 40 lbs by Consuming Before Bed for a Week

lose 40 lbs by consuming before bed for a week...

October 30, 2026

12:08 pm

Stars are now ditching botox thanks to this new product.

stars are now ditching botox thanks to this new product....

October 30, 2026

11:47 am

I did this and my knees and joints haven’t hurt for 10 years now.

i did this and my knees and joints haven’t hurt for 10 years now....

October 30, 2026

12:03 pm

America is in Shock! It Helps to Get Rid of Varicose Veins. Do It at Night

america is in shock! it helps to get rid of varicose veins. do it at night...

October 30, 2026

11:45 am

Admin rights blunted the backdoor, but cleanup still matters

The most dangerous step had a limit. “Turning on the local SSH service requires admin rights,” Cursor wrote. The malicious extension “does not have” those rights “on most macOS and Windows hosts.” Without a running SSH service, nobody can log in with the planted key.

That doesn’t make an infected machine clean. The planted key, the data it sent and the persistence scripts could all still be there. And on a machine where SSH was already on, the admin barrier would not apply.

Cursor is blunt about cleanup. “Uninstalling the extension may not be sufficient,” its notice says, because “the payload drops standalone persistence scripts that keep running.”

Doctor: If You Have Nail Fungus, Do This Immediately

doctor: if you have nail fungus, do this immediately...

October 30, 2026

12:10 pm

If You Find Moles or Skin Tags on Your Body, Read About This Remedy

if you find moles or skin tags on your body, read about this remedy...

October 30, 2026

11:42 am

This is a sign! Money is in sight! Read this and get rich.

this is a sign! money is in sight! read this and get rich....

October 30, 2026

12:10 pm

Hair growth increases by 272%! Not everyone knows this method...

hair growth increases by 272%! not everyone knows this method......

October 30, 2026

11:56 am

The environment variable list matters too. Cursor and the researchers both describe the code taking names, not values. Even so, names can show which cloud services and AI tools a developer uses. That is a map of where to go next once a backdoor works.

Anthropic’s official builds look clean

OpenSourceMalware says three official versions are not malicious. They are the Claude Code package on npm, the Open VSX extension and Microsoft’s VS Code Marketplace version. It adds that its findings alone don’t show any compromise of Anthropic’s release systems.

We checked the Open VSX listing on Friday. Version 2.1.314 is now the latest, posted at 01:07 UTC on October 30 by a verified publisher. Version 2.1.313 returns “not found.” Cursor’s notice does not mention 2.1.314, so updating is a step alongside cleanup, not a replacement for it.

4 Signs Telling That Parasites Are Living Inside Your Body

4 signs telling that parasites are living inside your body...

October 30, 2026

11:56 am

A spoon on an empty stomach burns 26 lbs in a week

a spoon on an empty stomach burns 26 lbs in a week...

October 30, 2026

11:53 am

Stars are now ditching botox thanks to this new product...

stars are now ditching botox thanks to this new product......

October 30, 2026

11:54 am

The secret of Buddhist monks: how to overcome joint pain.

the secret of buddhist monks: how to overcome joint pain....

October 30, 2026

12:11 pm

We found no public statement from Anthropic on the incident as of Friday. The episode is separate from the startup Cathedral’s recent claim that its AI agents got into Anthropic’s internal systems during an authorized test.

How to check a machine that ran Cursor on October 29

Cursor’s advice applies to anyone who installed or updated Claude Code from its marketplace during that 11-hour window. Its notice includes commands and cleanup scripts for macOS and Windows. These are the main steps.

• Look for a key ending in svc-telemetry in ~/.ssh/authorized_keys for every user account.
• Isolate the machine first, and keep logs if your company has a security team.
• Remove the key, the LaunchAgent or scheduled task, and any tunnel process with Cursor’s scripts.
• Consider a full rebuild, which OpenSourceMalware calls safer than deleting known files.
• From a clean device, rotate the passwords, API keys, SSH keys and cloud sessions the machine could reach.

OpenSourceMalware also lists the attacker’s server, 134.209.82.225. Network teams can search firewall logs for traffic to it on ports 22 and 8099.

Varicose Veins Will Disappear in the Morning! Read!

varicose veins will disappear in the morning! read!...

October 30, 2026

11:51 am

Doctor: If You Have Nail Fungus, Do This Immediately

doctor: if you have nail fungus, do this immediately...

October 30, 2026

11:50 am

If You Find Moles or Skin Tags on Your Body, Read About This Remedy. Genius!

if you find moles or skin tags on your body, read about this remedy. genius!...

October 30, 2026

12:09 pm

After Reading This, You Will Be Rich in 7 Days

after reading this, you will be rich in 7 days...

October 30, 2026

12:01 pm

Why AI coding extensions make tempting targets

Extensions like Claude Code run inside the editor with the developer’s own permissions. They can read project files, run terminal commands and see how a laptop connects to company systems. That access is what makes them useful, and it is exactly what an attacker wants.

This attack didn’t need a fake brand or a lookalike name. It used the real publisher name and a believable next version number, in the store where users expect safe updates. Cursor’s notice covers anyone who “installed or updated” to 2.1.313, so a routine update was enough.

That puts the burden on marketplace operators, not users.

Cursor has explained what the code did and how to clean up. It hasn’t explained how a package under Anthropic’s name got published without Anthropic. With AI tools now speeding up attackers too, companies that run Cursor will want that answer. Cursor says it is contacting affected users directly and takes questions at [email protected].

Disclosure: BreezyScroll uses Anthropic’s Claude to help draft articles.