For about 11 hours on October 29, if you used Cursor and had auto-update on, your Claude Code extension may have updated itself into a backdoor. Not a lookalike with a typo in the name. The real extension ID, anthropic.claude-code, under the real publisher name, served from Cursor's marketplace.
What Happened
- The bad builds: versions 2.1.312 and 2.1.313 of
anthropic.claude-code, served through the Cursor extension marketplace only. Microsoft says they never hit the Visual Studio Marketplace or npm, and Anthropic says it didn't build them and its systems weren't compromised. - The window: roughly 2:27 a.m. to 1:35 p.m. Pacific on October 29.
- The reach: Cursor says up to 5,000 users. It pulled the packages, took its marketplace down temporarily, and is contacting affected users. Anthropic shipped a clean 2.1.314.
- How it got there: nobody has said publicly yet. That's the question I most want answered.
What the Backdoor Did
Per Microsoft's and OpenSourceMalware's analysis, about 66 lines of loader code were stuck in front of the real extension. When it ran, it:
- Added an attacker SSH key to
~/.ssh/authorized_keys, labeledsvc-telemetryso it looks boring. - Tried to turn on SSH and opened a reverse tunnel to attacker infrastructure.
- Set up persistence (LaunchAgent on macOS, crontab on Linux, scheduled task on Windows).
- Phoned home over plain HTTP with your hostname, username, Git email, working directory and the names of environment variables that looked like secrets (
KEY,TOKEN,AWS, and friends). Names, not values. Which reads a lot like a shopping list for later.
Cursor says enabling SSH usually failed on Mac and Windows without admin rights. Don't take comfort in that. The key and persistence could still land, and both Cursor and Microsoft say to clean up regardless.
Why This One Matters
This is the third developer-tool story on this site in a week, after EMBRACE and the AGENTS.md hijack. The pattern is clear: attackers have figured out that the developer laptop is where the keys live, and AI coding tools are the newest, fastest-moving software on it.
Extension marketplaces are package registries with less scrutiny and auto-update turned on. "It came from the official marketplace under the official name" is no longer a security control. It's a hope.
What To Do
- Check every machine running Cursor for
anthropic.claude-code2.1.312 or 2.1.313. Update to 2.1.314 or later. - Look for the
svc-telemetrykey inauthorized_keys, plus the persistence entries. Preserve evidence, then remove them. - Rotate the secrets whose names were collected on any affected host. Assume the attacker now knows which ones to go after.
- Block and hunt for connections to
134.209.82.225on port 8099. - Lock down extensions: allow only approved publishers and add an install cooldown so brand new versions sit for a day before they reach your developers. Cursor now offers both.
- Watch developer egress. A new outbound SSH tunnel or an unencrypted beacon from a dev laptop should never be a quiet event.
Bottom Line
The attacker didn't need to trick anyone into installing anything. They rode an auto-update. Treat your IDE's marketplace like the software supply chain it is, because attackers already do.
Sources: Microsoft Security, Cursor security notice, and The Hacker News