Fake Claude Code extension on Cursor exposed up to 5,000 users to a backdoor over 11 hours

Hi, I'm Haru Misaki. This isn't one of my usual "look what I built with AI" stories. This time, the tool people use to install agents became the way in for an attack. On Cursor's marketplace, where editor extensions are distributed, a tampered Claude Code extension still listed under Anthropic's name was available for about 11 hours. I followed the incident by reading through security firms' analyses, Hacker News threads and news reports. To be clear up front: I did not run the malicious code myself.

What happened: a fake that sat on the shelf for 11 hours

Someone reportedly gained publishing access to Cursor's marketplace and released a tampered Claude Code extension that still carried Anthropic's name, according to Cursor's notice as shared by Florian Roth of Nextron Systems in a post on X. The affected versions were 2.1.312 and 2.1.313, and they targeted the macOS ARM64 build (Macs with M1 or later chips) and the Windows x64 build.

They were available from 09:27 to 20:35 UTC on October 29, roughly 6:30 p.m. on the 29th to 5:30 a.m. on the 30th in Japan, or about 11 hours. Cursor's initial estimate reportedly put the number of people who may have installed them during that window at up to 5,000. Cursor then pulled the versions, took down the attacker's server and released a cleanup script for users.

The key point is that the versions on the official VS Code Marketplace and Open VSX were not affected. The extension Anthropic built was not compromised itself. Someone put a fake on Cursor's shelf. But to a user, the name and publisher looked like the usual Claude Code, and the update arrived automatically. There was almost no way to tell 🤔

Agentic coding, where developers hand more and more work to AI, has become routine, and installing agents inside the editor is now an everyday task. That installation step turned out to be the least protected part.

Inside the backdoor: it runs as soon as the editor opens

StepSecurity's analysis gives the most detail on the malicious code. The tampered extension.js, the extension's main file, is about 7KB larger than the legitimate one, because a malicious loader (a component that pulls in and runs another program) was added at the top. The nasty part is that it ran when the editor launched, even if the user never opened the Claude chat. People who had installed it but not used it yet were not safe either.

Put simply, the goal was to "make a copy of the key to your computer and dig a tunnel back to the attacker's house." Specifically 👇

• Planting an SSH key: SSH lets you log in to another computer over the network. The code added the attacker's public key to authorized_keys, the list of keys allowed in. The key reportedly carried the label svc-telemetry, a name meant to look legitimate
• Opening a reverse tunnel: It opened a connection from inside the machine to a C2 server (the server an attacker uses to send commands) at 134.209.82.225 on ports 22 and 8099. That lets an outsider reach a computer sitting behind a home or office router
• Staying put: It set up a mechanism to start automatically at every login

The report from Phorion, the EDR vendor (EDR products watch for suspicious activity on a computer) that first spotted the attack, breaks it into four stages: planting the SSH key, the reverse tunnel, persistence (LaunchAgents on macOS, cron on Linux and scheduled tasks on Windows, all ways to run things automatically) and reconnaissance. The reconnaissance stage collected the names of environment variables and sent a beacon, a signal that the machine was alive. The report says the C2 server was down by October 30.

What honestly gave me chills was the choice of "telemetry" (a feature that reports usage data), a name you would expect from a developer tool. Even if you happened to open authorized_keys, you could easily shrug it off as something some tool had added 👀

Was the damage as bad as the headline? The parts that didn't work

This next part deserves a calmer read. "A backdoor for up to 5,000 users" is a striking number, but the more I dug, the more it looked like many machines may have escaped.

According to Cursor's explanation as reported by superpowerdaily, enabling SSH remote login requires administrator privileges, and on many macOS and Windows machines the extension did not have them. The malicious code also reportedly had bugs that made this stage fail even more often. Maybe the attacker wrote the code in a hurry. Either way, the main goal of planting a key and getting in through a reverse tunnel may not have worked.

That still doesn't mean anyone is in the clear. Hostnames, usernames, Git email addresses, public IP addresses and the names of token-like environment variables were reportedly sent out before the server went down. Even with names only and no values, that is enough for a map: this person, at this company, holds keys for these services. Cursor itself reportedly said that the small amount of data collected does not rule out credentials being taken later through the backdoor.

One more point: as far as I could find, no user has yet reported actually finding the svc-telemetry key. The figure of up to 5,000 is a ceiling on people who may have installed the extension, not a count of confirmed compromises. Mixing the two up turns this into a scare story, so please keep the meaning of that number separate 💡

Shifting information: a corrected first report and anger on Hacker News

The information came out in a messy way. Phorion's first report went up at 05:30 UTC on October 30. As its URL shows, it described a compromise of the official extension itself and included Open VSX. About four hours later, at 09:13 UTC, it was corrected to say the impact was limited to Cursor's marketplace. Then at 00:43 UTC on October 31, version 2.1.312 was added to the affected versions. At first, only 2.1.313 was thought to be involved.

It helped that the people who found it went public quickly. But some early reports, including cellcog's, reportedly still say Open VSX was affected. It became a textbook case of how first reports on an incident can be wrong. "AI forensics" (investigating AI-related incidents and tracing the evidence) is a buzzword now, but investigators can only keep stacking up timestamped corrections.

The Hacker News thread hit No. 1 on the front page with 967 points and 547 comments. A separate thread on the same topic reached 655 points. In the thread, Anthropic's Felix Rieseberg explained that neither Anthropic's systems nor its employees' devices were compromised, and that access to Cursor's marketplace had been abused.

The comments were harsh, though. Common complaints: it makes no sense to show "Made by Anthropic" without any signing (an electronic stamp that proves something is genuine). What about trademark control? And it was unclear which channel was official, which made communication during the crisis confusing. I agree with this. The biggest problem is a shelf where anyone can claim to be official. Agent governance, meaning how we manage the permissions and trust given to AI that takes actions, has to cover not just the AI itself but also the path that delivers it.

How to check your computer (removing the extension isn't enough)

This is the most important part. According to Notebookcheck's report, a planted key and persistence mechanism stay in place even if you upgrade to the fixed version, 2.1.314, or uninstall the extension. A copy of your key left behind by a burglar doesn't vanish just because you replaced the front door.

• Check first: Open .ssh/authorized_keys in your home folder and look for a key labeled svc-telemetry
• Windows users, check two places: In addition to the file above, check C:\ProgramData\ssh\administrators_authorized_keys
• If you find it: Run Cursor's cleanup script. Then, from a separate, clean device, rotate all your tokens and API keys (if you change passwords on a compromised machine, the new ones could be seen too)
• The safest option: Reinstalling the operating system is recommended

Another lead is to check router or company logs for traffic to the C2 IP address in StepSecurity's analysis (134.209.82.225) or to port 8099. For teams, the fastest place to start is probably identifying which members had Cursor open during the affected window on October 29 🛠️

A final thought from me. Between MCP server vulnerabilities and Agent Skills, the ways to add tools to agents keep multiplying. As they do, the burden of checking where something came from and whether it's genuine tends to fall on users. This time, the administrator-privilege barrier and the bugs seem to have helped. But if the next attacker writes more careful code, it won't be funny. When I install a handy extension, I'll check which store is distributing it. That much, at least, I want to make a habit.