Cursor says version 2.1.313 of the Claude Code extension was published under Anthropic's verified account and tried to install a persistent SSH backdoor; the company puts the impact at no more than 5,000 users.

An official Claude Code extension for Visual Studio Code-compatible editors was trojanized on the Cursor marketplace, exposing as many as 5,000 developers, according to reports published Friday by Ars Technica and The Hacker News. Cursor said version 2.1.313 was posted through Anthropic's verified account and affected "at most 5,000 users." Installs happened between about 5:27 a.m. and 4:35 p.m. US Eastern time on Thursday, Oct. 29, 2026, which is 2:27 a.m. to 1:35 p.m. Pacific. Anthropic later published version 2.1.314.

According to Cursor and security firm Phorion, as relayed by Ars Technica, the malicious code tried to add an attacker-controlled SSH key, enable the local SSH service, open a reverse tunnel and set up persistence on Windows, macOS and Linux. The Hacker News reported that it also sent host reconnaissance, including up to 40 environment variable names containing words such as KEY, TOKEN or SECRET, though not their values, and that no follow-on payloads were observed. Cursor noted that enabling SSH usually requires administrator rights, but said key insertion, persistence and data collection still occur. Phorion added that bugs stopped the backdoor working in some cases, yet it remained a significant threat.

Cursor said the build was not developed by Anthropic, removed it, briefly closed its marketplace to rotate keys and audit access, and said other extensions were not affected. How the attackers gained control of the official account has not been explained, and Ars Technica reported that Anthropic had not issued a public notice to customers and that neither company answered its questions. Anyone who installed or updated the extension from Cursor during that window should isolate the machine, remove the unknown SSH key and persistence entries, and rotate credentials; auto-update is on by default in Cursor, so users may have received the build without acting.