Tampered Claude Code Extension Slips SSH Backdoor Into Cursor Marketplace

Key Takeaways

• A tampered Claude Code extension was live in Cursor's marketplace for about 11 hours on October 29, 2026.
• Cursor said up to 5,000 users on Windows and macOS may have been affected.
• The code ran on load and tried to add an attacker's SSH key, a reverse tunnel, and persistence.
• Bugs stopped most SSH setup, but key planting and data collection could still succeed.

A Trusted Update Channel Delivers a Backdoor

Cursor's extension marketplace served a tampered build of Anthropic's Claude Code extension that tried to give an attacker remote access. Reuters reported that up to 5,000 users may have received it, many through automatic updates.

What We Know

The malicious versions, 2.1.312 and 2.1.313, were live from about 2:27 a.m. to 1:35 p.m. Pacific on October 29. Security firm Phorion found a short loader added ahead of the real code.

As CSO Online reported, Cursor removed the versions, took its marketplace offline, rotated keys, and rebuilt it.

Anthropic said an attacker used access to Cursor's marketplace and that its own channels were unaffected. The Register reported the statement followed claims of a breach at Anthropic. Cursor has not explained how the access was obtained.

What Happened

The loader tried to add an attacker's SSH key, enable SSH, and open a reverse tunnel, plus startup entries to survive a reboot.

Microsoft reported it also collected machine and user details and listed environment variable names containing words like KEY or TOKEN, though not their values.

Bugs meant enabling SSH usually failed without admin rights. The real target was clear: coding agent extensions run with full developer privileges next to code, cloud credentials, and model keys.

Why It Matters

This was confirmed malware delivered through an official update channel. Affected users had to check SSH keys, remove hidden persistence, and rotate credentials.

Editors like Cursor run their own marketplaces for other vendors' extensions. A developer's trust in a known AI brand depends on a marketplace that brand does not control.

AI coding extensions belong in software supply chain governance: inventory, allowlisting, controlled updates, and provenance checks.

PointGuard AI Perspective

The attack worked because AI developer tooling installs and updates itself outside most security programs. PointGuard AI brings that layer into view.

AI discovery builds a continuous inventory of AI tools, agents, and MCP servers across clouds, repositories, IDEs, and runtime telemetry. Teams know which coding assistants developers run before an incident forces the question.

PointGuard AI supply chain security scores AI components on publisher trust and known vulnerabilities and supports AI-BOMs, giving teams evidence to approve, restrict, or block them.

Agentic endpoint security extends visibility to the workstations where this extension did its work. Ownership workflows make sure cleanup requests reach the right team fast.

As AI coding tools become standard, every agent, extension, and marketplace should be treated as part of the software supply chain.

Incident Scorecard Details

Total AISSI Score: 7.60/10

Criticality: 8, Developer machines hold code, cloud credentials, and AI keys. AISSI weighting: 25%

Propagation: 6, Automatic updates reached up to 5,000 machines through one marketplace. AISSI weighting: 20%

Exploitability: 7, Malware confirmed in distribution, though bugs limited the backdoor. AISSI weighting: 15%

Supply Chain: 9, Compromise sat entirely in a third-party marketplace. AISSI weighting: 15%

Business Impact: 8, Confirmed customer impact, cleanup, marketplace shutdown, and wide coverage. AISSI weighting: 25%

Sources

Third-Party Sources

• Reuters via The Star: Cursor says up to 5,000 users affected by tampered Claude Code extension
• CSO Online: Cursor removes malicious Claude Code extension after SSH backdoor attempt
• The Register: Anthropic says the Claude Code extension compromise was not on its side

PointGuard AI Sources

• PointGuard AI Discovery
• PointGuard AI Supply Chain Security
• PointGuard AI Agentic Endpoint Security