- Cursor says a modified Claude Code extension was in its marketplace for about 11 hours on October 29 and may have reached up to 5,000 users.
- It left an attacker's SSH key and background scripts. The step that turns on SSH access failed on almost all hosts, and Cursor says the attacker's server is offline.
- Check developer machines for the key, isolate any host that has it, and rotate the credentials that host could reach.
No one had to click a strange link. A developer's editor offered an update to a tool they already used, under the name they already knew. That was the whole attack.
Cursor, an AI code editor built on VS Code, runs its own extension marketplace. On October 29, 2026, it warned that a tampered build of the Claude Code extension had been listed there. The build was version 2.1.313. Cursor says it was available for about 11 hours, from roughly 2:27 AM to 1:35 PM Pacific. Cursor puts the number of people possibly affected at 5,000 or fewer.
OX Security, a security firm, published its analysis on October 30.
Anthropic did not write the bad version. The weak point was Cursor's marketplace, not Anthropic's own release channel. Cursor has seen no sign that other releases of the extension, Anthropic's official channel or other extensions were affected.
What the payload did
OX Security lists four actions. Each is simple. Together they leave an outsider a foothold on a developer's machine.
First, the code gathered facts about the machine. These included the username, hostname, operating system, home folder, Git email and public IP address. It also took the names of environment variables.
Second, it added an attacker's public key, labelled svc-telemetry, to the user's SSH authorized_keys file. That file lists which keys may log in to the machine over SSH.
Third, it tried to switch on the local SSH service and open a reverse tunnel to a server at 134[.]209[.]82[.]225. A reverse tunnel makes the victim's machine dial out to the attacker. The attacker can then use that connection to reach back in.
Fourth, it installed persistence. That means scripts that keep running after the extension is gone. They retry the tunnel about every 60 seconds. On macOS, OX lists a LaunchAgent named com.apple.sysmond. On Windows, it lists a scheduled task named SysMon. Both names look like system tools.
What limited the damage, and what did not
Enabling the SSH service needs administrator rights. The extension normally lacks them. Cursor says errors in the attacker's code made that step fail. The exception was the unusual case where Cursor ran with administrator rights.
So on most machines the tunnel gave the attacker no way to sign in. Cursor also says the attacker's server is now offline. The beacon, which is the signal the code sent home, and the tunnel no longer work.
That does not make the incident harmless. OX stresses that the key, the persistence scripts and the report of host details were still put in place. The key and scripts stay until someone deletes them. Cursor's advice is that uninstalling alone may not be enough.
The lesson: the label was real, the contents were not
Security training tells staff to install software only from trusted publishers. Here the publisher name was right. The failure sat one level up, in the marketplace that delivered the update.
This incident shows that a compromised marketplace can turn a trusted extension update into code running on a developer's machine. OX points out that such code can write SSH keys, set up startup tasks and open network tunnels. Any credentials that machine can reach are then at stake.
The next point is our interpretation, not OX's finding. An AI coding assistant is one more extension that people trust by name. One incident does not show that AI tools are riskier than other extensions. The same path exists for any extension store of this kind.
The clean-up carries a second lesson. Uninstalling the extension is like dismissing the locksmith without changing the locks. The attacker's key stays in authorized_keys until someone removes it.
What to ask your team this week
Start with exposure. Ask who installed or updated Claude Code in Cursor on October 29, and which version they received. The risky window ran from about 2:27 AM to 1:35 PM Pacific. Ask whether your tooling can show extension installs at all.
Then run the check OX provides. On macOS and Linux, it searches ~/.ssh/authorized_keys for svc-telemetry. On Windows, it searches the user's authorized_keys file and C:\ProgramData\ssh\administrators_authorized_keys. If the key is present, OX says the machine is impacted.
For any such host, follow the steps Cursor gives. Isolate it. Remove the key, the persistence and any running tunnel processes. Decide whether to rebuild it. Rotate credentials and sessions that the host could reach, working from a trusted system. OX notes that the limited variable collection does not rule out credential access through the backdoor later.
One caution on indicators. Cursor saw the code look up its public IP through ifconfig[.]me and api[.]ipify[.]org. Both are ordinary services. A connection to them alone proves nothing.
Last, ask a policy question. Who decides which editor extensions run on machines that hold production access, and how fast could you tell if one went wrong? Removing the extension closes the door the attacker came through. It does not take back the key they left behind.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: OX Security.
