2026 Cursor — malicious build of Anthropic's Claude Code extension in the Cursor marketplace installed SSH backdoors; up to 5,000 developers (press estimate)

Data compromised

Host and user information sent to the attacker: hostname, username, OS, architecture, home directory path, environment variable names, working directories, Git email and public IP. Cursor says it has no evidence that other extensions or the official distribution were affected. It has not published an install count; press reports cite up to 5,000 developers.

Technical writeup

Root cause

Cursor says versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension, available in its VS Code extension marketplace between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026, were malicious and were not developed by Anthropic. The code tried to add an attacker SSH key, enable SSH, open a reverse tunnel and set up persistence. Cursor removed the version, shut the marketplace down while it rebuilt it, and worked with the host to take the attacker's server offline.

References

• https://cursor.com/blog/claude-code-extension-security-notice
• https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/