A malicious Claude Code extension planted an SSH backdoor—updating alone is not enough
Cursor says malicious versions 2.1.312 and 2.1.313 were served to macOS and Windows users for about 11 hours. The server is offline and distribution has stopped, but affected machines may retain an unauthorized SSH key and persistence files that must be removed.
The short version
- What happened
- Cursor says malicious macOS and Windows builds of Anthropic.claude-code versions 2.1.312 and 2.1.313 were available in its extension marketplace from about 2:27am to 1:35pm Pacific Time on 29 October.
- Who it affects
- Developers may keep source code, cloud credentials and signing access on the same computer as their editor. A hidden SSH authorization entry can therefore put personal work, employer systems and software customers at risk even after the visible extension has been updated.
- What remains unproven
- The verified exposure concerns malicious macOS and Windows builds served through Cursor's marketplace. Microsoft says official Anthropic distribution, Microsoft's Visual Studio Marketplace and npm were not affected.
Keep in mind
The verified exposure concerns malicious macOS and Windows builds served through Cursor's marketplace. Microsoft says official Anthropic distribution, Microsoft's Visual Studio Marketplace and npm were not affected.
No reviewed primary source gives a final count of installations, successful tunnels, attacker logins or stolen secrets. Environment-variable names were collected; Microsoft says that alone does not demonstrate theft of their values.
The attacker server is offline, but that does not remove local persistence. Readers should use the maintained official notice rather than copying isolated commands from secondary reports.
Multi-source analysis · 2 linked sources. Primary analysed source date: 29 October 2026. Latest linked supporting source: 30 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
The package disappeared, but its changes can remain
Cursor has told users to check macOS and Windows computers that installed or automatically updated Anthropic's Claude Code extension from its marketplace during an approximately 11-hour window on 29 October. The company says versions 2.1.312 and 2.1.313 contained injected JavaScript that collected device and user details, looked for environment-variable names associated with credentials, added an attacker-controlled SSH key and attempted to establish a persistent reverse tunnel. Anthropic did not develop the malicious builds.
Distribution has ended: Cursor removed the packages, shut down and rebuilt its extension marketplace, rotated keys and worked with the hosting provider to disable the attacker server. That reduces immediate command-and-control risk, but it does not clean a machine. The code wrote an SSH authorization entry, scripts and startup configuration outside the extension folder. Cursor therefore warns that updating to a safe release or uninstalling the extension can leave the attempted backdoor and persistence behind.[1][2]
Affected teams need evidence-led cleanup, not a version check
The official response is to identify installations from the Cursor marketplace in the stated window, preserve evidence, isolate machines showing payload execution, remove the unauthorized key and persistence, stop tunnel processes and review endpoint and network telemetry. Credentials and sessions accessible from an affected computer should be rotated from a trusted machine when investigation indicates exposure or device trust cannot be restored. Cursor supplies platform-specific checks, indicators and remediation scripts; Microsoft adds hunting guidance and stresses that cleanup should preserve unrelated SSH configuration.
The incident's denominator remains uncertain. The current notice does not report how many devices installed the malicious builds, how many successfully opened a tunnel or whether an attacker used a tunnel to access a machine. Microsoft says successful remote access depended on privileges, SSH configuration and server settings; code capability is not proof that every step succeeded. The narrow verified claim is still consequential: a trusted marketplace served a tampered AI-coding extension, and potentially affected hosts require action beyond a routine update.[1][2]
The distinction that matters
Who needs to act, and why?
The relevant test is distribution channel, version and time—not whether the extension now looks current.
Exposure
Cursor marketplace on macOS or Windows; versions 2.1.312 or 2.1.313 during the 29 October window
Run Cursor's official checks and inspect installation records
Artifacts
Look for the unauthorized SSH key, scripts, startup entries and tunnel processes
Preserve evidence, isolate and remove confirmed malicious components
Recovery
Review telemetry and assess whether credentials or sessions were exposed
Rotate from a clean device and rebuild when trust cannot be restored