Cursor says about 5,000 people may have installed a tampered Claude Code extension that tried to plant an SSH backdoor

Cursor, the maker of an AI coding editor, says a maliciously modified version of Anthropic’s Claude Code extension was available in its extension marketplace on Thursday, 29 October, and that around 5,000 people may have installed it, according to The Verge.

In a security notice, Cursor said versions 2.1.312 and 2.1.313 of the extension for Windows and macOS were available between about 09:27 and 20:35 GMT. It said those versions “were not developed by Anthropic”.

According to Cursor, the code collected host and user details, including usernames, hostnames, environment variable names and public IP addresses, and tried to add an attacker-controlled SSH key, open a reverse SSH tunnel and make it persistent. Cursor said that, because of errors in the malicious code and a lack of administrator rights, the tunnel step would fail on most machines. It said the attacker’s server had been taken offline with the help of its hosting provider.

Cursor said it removed the tampered versions, shut down and rebuilt the marketplace, rotated its keys and found no other extensions had been altered. It said it had no evidence that other versions or the official distribution were affected. Microsoft’s security team also published an analysis of the extension on 30 October.

Cursor has told anyone who installed the affected versions to check for an SSH key labelled “svc-telemetry”, run its remediation scripts and rotate credentials accessible from those machines. It said uninstalling the extension alone “may not be sufficient”. Cursor updated the notice on 30 October.