Cursor reports malicious Claude Code extension with SSH backdoor in marketplace
READ THE ORIGINAL SOURCEOpen original sourcecursor.com · Opens in a new tabCursor reports a security incident in which a malicious version (2.1.313) of the Anthropic.claude-code extension, not developed by Anthropic, was available in the Cursor VS Code extension Marketplace for about 11 hours on October 29, 2026. The extension collected host and user information and attempted to add an attacker-controlled SSH key, enable SSH, open a reverse tunnel, and establish persistence. Cursor says at most 5,000 users were affected, removed the version, took the attacker server offline, and published indicators of compromise and remediation scripts.
One primary source; other links are context, not independent corroboration.
- Primary sourceX discovery · automated brief
- Discovery linkX
- Linked in sourceremediate-macos.sh
- Linked in sourceremediate-windows.ps1
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
Open full article view →- Linked article+30
- Fetched source page+30
- No editor link review+0
- Original non-discussion link+5
This measures the stored source trail and editorial steps. It does not certify accuracy, peer review, or independent corroboration. Popularity adds no points.
View full scoring →Read the scoring rubric →What the source says
Cursor reports a security incident in which a malicious version (2.1.313) of the Anthropic.claude-code extension, not developed by Anthropic, was available in the Cursor VS Code extension Marketplace for about 11 hours on October 29, 2026. The extension collected host and user information and attempted to add an attacker-controlled SSH key, enable SSH, open a reverse tunnel, and establish persistence. Cursor says at most 5,000 users were affected, removed the version, took the attacker server offline, and published indicators of compromise and remediation scripts.
A READER'S EVIDENCE CHECKHow to read this signalSix questions about claims, sources, risks, and open checks
This is a signal-level guide until claim-level evidence is available. “Not recorded” means the evidence has not been assessed here; it does not mean a result is false. How we check AI news →
- 01Who is making each claim?
The claimant and whether each claim was measured or asserted are not recorded in this public brief.
- 02What was actually tested?
Not recorded per claim. Check the source for sample size, tasks, model and benchmark versions, and reproducibility.
- 03Where are the sources?
Original link: cursor.com. Brief basis: fetched source page. Primary page date and quote locations are not established in this panel.
- 04What could mislead?
Source claims not independently checked; the account is the vendor's own incident notice.
- 05What is at risk if wrong?
Not assessed per claim. Consider safety, privacy, cost, and adoption decisions before relying on the result.
- 06What would change the view?
No claim-specific check is recorded. An inspectable primary method or independent replication could change the assessment.
Key findings from the stored brief
- Malicious Anthropic.claude-code 2.1.313 was available in the Cursor marketplace between 2:27am and 1:35pm PT on October 29, 2026.
- The extension attempted to add an attacker SSH key, enable SSH, open a reverse tunnel, and install persistence via LaunchAgent or scheduled task.
- Cursor states at most 5,000 users were affected and the attacker server was taken offline with its hosting provider.
- Uninstalling the extension may not suffice, since the payload drops standalone persistence scripts that keep running.
Source claims not independently checked; the account is the vendor's own incident notice.
This is a source-based abstract, not independent validation of the source's claims.
Evidence & sources
These links show where the signal came from and what the source page linked to. A linked page is context, not independent corroboration.
Related archive coverage
These relationships record a citation or topic overlap, not confirmation of the finding.
Grok Bot submitted the link. AINewsIQ fetched the primary source and prepared a source-based brief automatically. An editor has not reviewed the story; social attention and the brief do not independently verify its claims.
These are Grok Bot discovery notes. AINewsIQ prepared a brief from available source material. The bot's rationale, linked posts, authors, and stances have not been independently verified.
Cursor says a maliciously modified Anthropic.claude-code 2.1.313, not developed by Anthropic, sat in its VS Code extension marketplace from about 2:27am to 1:35pm PT on Oct 29 and tried to install a persistent SSH backdoor. At most 5,000 users were affected; Cursor rotated keys and rebuilt the marketplace.
Source claims not independently checked; the account is the vendor's own incident notice.
Engagement counts, when shown, are observed snapshots. They do not establish accuracy or corroboration.
- x post ↗ · 2,279 likes, 378 reposts, 212 replies, 246 quotes · observed 10/30/2026, 10:07:05 AM
- Related post ↗
- Related post ↗
Timeline & updates
- Signal dated by source or discovery feed
This timestamp places the signal in the radar. It may be the discovery post date rather than the primary page's first publication date.
- Shared brief stored
AINewsIQ prepared one abstract from fetched source page.
A publication revision history is not stored for this signal. New engagement snapshots do not mean the source itself changed.
Why this may matter
The incident shows that extension marketplaces are an attack vector for developer machines, and that a trusted extension name can be impersonated. Affected developers may need host rebuilds and credential rotation, not just uninstalling.
Limits and open questions
Source claims not independently checked; the account is the vendor's own incident notice.
Organization-specific financial, security, and operational effects require the organization's own context and review.
Discussion
Comments are reviewed before publication. Discuss the evidence, not the person.
No published comments yet.
Reader discussion opens with accounts. You can read the original source and published comments now.