Claude Code Backdoor Review 2026: Cursor Marketplace Breach

This analysis was written by the aifreetool Editorial Team, a group of full-time AI-industry researchers who verify every claim against vendor advisories and independent security research. Last updated November 4, 2026. We keep no affiliate relationship with the companies covered here.

TL;DR: A tampered build of Anthropic's Claude Code extension sat in Cursor's official marketplace for about 11 hours on October 29, 2026, and at most 5,000 developers downloaded it. The marketplace backdoor planted an attacker-controlled SSH key and persistence scripts, so uninstalling the extension was not enough to clean a machine. Most victims dodged the worst outcome only because the attacker's shell code contained bugs.

What happened on October 29

Between roughly 2:27 a.m. and 1:35 p.m. Pacific time, versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension were downloadable from Cursor's VS Code extension marketplace. This was not a lookalike. The package carried Anthropic's real extension identifier on Windows and macOS builds, so nothing on the listing page looked wrong. Cursor's security notice puts the ceiling at 5,000 affected users and states plainly that the malicious version was not developed by Anthropic.

Anthropic engineer Felix Rieseberg confirmed the tampered copy was not built or published by Anthropic, and that versions distributed through Microsoft's VS Code Marketplace and the open source Open VSX registry were unaffected. The attack was scoped to Cursor's own distribution channel, which is what makes it worth studying rather than shrugging off.

What the payload actually did

Analysis published by OX Security, summarized in an incident timeline, found a 66-line JavaScript loader prepended to the extension's extension.js file. It executed when the module loaded, with no interaction required from Claude Code itself and nothing suspicious visible in the tool's normal behavior. The loader collected the hostname, username, operating system, architecture, home directory path, environment variable names, working directory, configured Git email, and public IP address.

Then it went for durable access. The code appended an attacker-controlled ed25519 key, labeled svc-telemetry, to the machine's authorized_keys file, tried to enable the local SSH service and open a reverse tunnel, and installed persistence through a macOS LaunchAgent or a Windows scheduled task that attempted to run as SYSTEM, with a startup script as fallback. A background script retried the tunnel about every 60 seconds and beaconed host details over HTTP POST to a /beacon endpoint on port 8099. Researchers tracking the campaign pointed at the server 134.209.82.225, which Cursor later took offline with the hosting provider, per the incident report.

Why most machines dodged the worst step

The full attack chain required admin rights that a code editor rarely has. On macOS, the malware's checks were not run with elevated privileges. On Windows, it mistakenly invoked a Unix shell path, /bin/sh, which Windows cannot execute. So on the majority of infected hosts the reverse tunnel never opened and the attacker could not log in remotely.

Do not read that as luck converting into safety. Cursor's own advisory warns that uninstalling the extension may not be sufficient, because the payload drops standalone persistence scripts that keep running. On every affected machine, the attacker's SSH key, the persistence mechanism, and the host-detail beacon all landed regardless of whether the tunnel worked. Cleanup therefore means checking authorized_keys by hand, removing the LaunchAgent or scheduled task, and matching indicators of compromise with the detection script Cursor published.

If you are picking an AI coding assistant this quarter, our AI programming tools directory and the Claude Haiku 5.5 pricing review cover the cost side of the same decision.

The response, hour by hour

The detection firm Phorion first flagged the malicious extension on a customer's Mac. Cursor pulled the package, then took its entire marketplace offline as a precaution, audited access logs, and reported that no other extension had been tampered with. Keys were rotated, the attacker's server was taken down through its hosting provider, and version 2.1.314 went out as the clean replacement. Security researcher Kevin Beaumont's estimate of roughly 5,000 downloads is the number most outlets converged on.

What Cursor has not published is the answer to the only question that prevents a repeat: how did someone publish under Anthropic's real extension identity in the first place? The advisory is silent on the entry point, and outside researchers have offered competing theories.

Anatomy of a marketplace supply-chain attack

Key Takeaways

• The tampered Claude Code extension lived in Cursor's marketplace for about 11 hours on October 29 and reached at most 5,000 developers.
• The payload added an SSH key, persistence scripts, and a beacon even on machines where the reverse tunnel failed, so uninstalling alone does not clean a host.
• Remediation: update to 2.1.314 or later, inspect authorized_keys for the svc-telemetry key, remove LaunchAgent or scheduled-task persistence, and run Cursor's detection script.
• AI tool marketplaces are now software supply-chain infrastructure and deserve the scrutiny teams already apply to npm and PyPI.

My Take / The Bottom Line

The headcount is small; the shape of the attack is not. A marketplace badge and a real extension ID used to be a reasonable trust signal, and this incident breaks that assumption permanently. Provenance checks at install time would not have flagged a 66-line prepend to a legitimately identified package, which means the marketplace's publication pipeline is the control that failed, and Cursor still owes the industry that post-mortem.

For developers, the stakes outrun the laptop. A coding assistant's host usually holds SSH keys to production servers, cloud credentials, and client repositories, so a developer-machine backdoor is a production breach with extra steps. This is also why the supply-chain theme keeps recurring across our deep-dive coverage of AI coding tools: the more agents touch real infrastructure, the more their update channels look like critical infrastructure. If your team builds with AI editors, treat the marketplace like a package registry, and pin and review updates accordingly.

FAQ

Q: Was the official Claude Code extension compromised?

A: No. Anthropic says the tampered builds were not developed or published by Anthropic, and versions on Microsoft's VS Code Marketplace and Open VSX were unaffected. Only Cursor's marketplace served the malicious 2.1.312 and 2.1.313 builds.

Q: How do I know if I was affected?

A: Run the detection script and indicators of compromise Cursor published, and check your authorized_keys file for an unrecognized ed25519 key labeled svc-telemetry. Also look for a suspicious macOS LaunchAgent or Windows scheduled task.

Q: Does uninstalling the extension remove the backdoor?

A: No. Cursor explicitly warns that the payload drops standalone persistence scripts that keep running after uninstall. You must remove the SSH key, the persistence mechanism, and any host matching the indicators of compromise.

Q: What version of Claude Code is safe on Cursor?

A: Version 2.1.314 and later are the clean replacements. Cursor removed the malicious packages, rotated its keys, and reopened the marketplace after finding no other tampering.

Q: Why does a code-editor extension matter for security?

A: Developer machines hold SSH keys and cloud credentials for production systems, so a backdoor on a coding tool is a direct path into infrastructure, not just a workstation nuisance.