Claude Code Extension Backdoor Hits Cursor Users

Illustration: Fox Bulletin

A Claude Code extension backdoor reached developer machines through the Cursor marketplace on 29 October. By Cursor’s own account a maliciously modified build of Anthropic’s extension was available between roughly 2:27am and 1:35pm Pacific, about eleven hours.

Two versions are affected, 2.1.312 and 2.1.313, on Windows and macOS. Cursor states plainly that these builds “were not developed by Anthropic”, and Microsoft says its own Visual Studio Marketplace and the Claude Code npm package were not involved.

What the Claude Code extension backdoor did

The injected code ran when the extension module loaded. It gathered host and user details, specifically hostname, username, operating system, architecture and public IP, and reported them out.

It then tried to establish access: adding an attacker-controlled SSH key to authorized_keys, enabling the local SSH service and opening a reverse SSH tunnel. Persistence was attempted through a LaunchAgent on macOS, or a scheduled task with a startup-script fallback on Windows, and background scripts retried the tunnel roughly every sixty seconds.

Cursor's published security notice about the modified extension — Image: Cursor

The planted key is labelled svc-telemetry, a name chosen to look like routine instrumentation in a file most developers never read closely.

Why most machines were probably fine

The SSH steps need administrator rights, which the extension does not have on a typical macOS or Windows account, so Cursor says they would likely fail. Microsoft makes the same point from the other direction: attempted execution is not proof of a successful compromise, and whether the backdoor worked depends on host privileges and local SSH configuration.

The caveat that matters more is about cleanup. Cursor warns that the extension may have left standalone persistence scripts behind, which means uninstalling it does not necessarily end the problem.

What Cursor did about it

It pulled the version, blocked further distribution and then shut the entire marketplace down rather than only the one listing. It audited access and confirmed no other extension had been tampered with, rotated keys, rebuilt the marketplace and brought it back. Working with the hosting provider, it also had the attacker’s server taken offline, and states that the server “no longer functions”.

Cursor has published remediation scripts for macOS and Windows along with indicators of compromise, and advises rotating any credentials reachable from an affected machine. Anyone who ran Claude Code inside Cursor that day should read the official notice rather than a summary of it.

That breadth of response is itself informative. Taking an entire marketplace down to audit it is expensive and disruptive, and companies do it when they cannot yet rule out that the same access was used elsewhere.

The wider lesson for developer tools

A code editor extension runs with the privileges of the person writing the code, which is why marketplaces are a target worth eleven hours of exposure. The credentials on a developer laptop usually reach further than the laptop does.

Basic hygiene helps more here than it does elsewhere. Our guide to the best password managers covers the rotation this incident calls for, and the Binance theft the same week began, on the exchange’s own account, with a compromised engineer laptop.

Written by Priya Raghunathan

Priya Raghunathan covers consumer and small-business technology for Fox Bulletin: apps, subscriptions and the hardware people actually buy. Comparisons are built from vendors' own pricing pages and App Store listings, on the principle that the headline price is rarely the price you end up paying.

View all posts →