Malicious builds of Anthropic’s AI coding extension were served to Cursor users for 11 hours, leaving attacker keys and persistence that outlast an uninstall.
A tampered version of Anthropic’s Claude Code extension was served to developers through Cursor’s extension marketplace for about 11 hours on Oct. 29. It planted an attacker-controlled SSH key, a reverse tunnel and startup persistence on machines that loaded it.
Cursor, whose AI code editor is built on Microsoft’s VS Code, disclosed the incident in a security notice the same day. It said the malicious builds, versions 2.1.312 and 2.1.313 for macOS and Windows, were available between about 09:27 and 20:35 UTC.
“The extension runs malicious code that attempts to install a persistent SSH backdoor,” the notice said.
Phorion, a macOS endpoint detection vendor, reported the compromise in an advisory early on Oct. 30. It explained why a poisoned extension is so potent.
“Because extensions run with the permissions of the IDE and the user running it, a backdoored extension gets immediate access to local files, source code, and developer tooling as soon as its module is loaded,” Phorion wrote.
Microsoft Threat Intelligence published its own analysis the same day. It said the malicious packages were never distributed through the Visual Studio Marketplace or the @anthropic-ai/claude-code npm package.
“Anthropic confirmed to Microsoft that their systems were not compromised and they did not develop the malicious package posted in Cursor marketplace,” the Microsoft post said.
Runs without user action
According to Phorion, the attacker prepended a block of JavaScript to the extension’s extension.js file, ahead of the legitimate code.
“The user doesn’t need to interact with the extension for the payload to fire,” Phorion wrote.
Microsoft’s analysis set out what happens next. The loader adds an Ed25519 public key labeled svc-telemetry to the user’s SSH authorized_keys file and tries to switch on the local SSH service. It then opens an outbound SSH connection to a server at 134.209.82[.]225 and asks it to forward traffic back to port 22 on the victim’s machine. Anyone holding the matching private key could then log in as that user.
The loader is designed to avoid notice, Microsoft said.
“It suppresses command output and silently catches errors to conceal failures and malicious activity, while the extension continues functioning normally to avoid alerting users,” the post said.
The malware also installs persistence named to resemble monitoring software. On macOS this is a LaunchAgent called com.apple.sysmond. On Windows it is a scheduled task named SysMon, with a Startup folder script as a fallback. It also reports the hostname, username and Git email to the attacker, along with the names, but not the values, of up to 40 environment variables matching terms such as KEY, TOKEN, SECRET, AWS and GCP, Microsoft said.
Bugs limited access
On most machines, the backdoor did not give the attacker a way in. Cursor said enabling SSH requires administrator rights the extension lacks on most macOS and Windows hosts, so the attacker could not have logged in through the tunnel on those machines.
Phorion traced the macOS failure to a faulty check. The script asks whether Remote Login is off, but without admin rights the command returns an access error instead, so the step that enables SSH is skipped. Phorion said the Windows setup also fails, because it runs through a helper hardcoded to the Unix shell /bin/sh.
The planted key still works on any Mac where Remote Login is already enabled or is turned on later, Phorion said. Microsoft said the loader “may still write keys and persistence artifacts even when tunnel access fails.”
Cleanup beyond uninstalling
Cursor told users who installed or updated to either version during the window to check authorized_keys for the svc-telemetry entry and isolate affected hosts. They should then remove the key, persistence and tunnel processes, and rotate credentials and sessions from a trusted system. Cursor published remediation scripts for macOS and Windows.
“Uninstalling the extension may not be sufficient,” the notice said.
Cursor said it removed the builds on detection and then shut down its entire extension marketplace as a precaution. It audited access, found no other tampered extensions, rotated its keys and rebuilt the marketplace before bringing it back online. It also worked with the hosting provider to take the attacker’s server offline. The notice does not say how the attacker obtained access to publish the builds.
Microsoft said the server takedown does not remove artifacts already on a device. It published Microsoft Defender detections and hunting queries. It also advised organizations using Cursor to apply the company’s security hardening guidance, which includes restricting extensions to approved publishers and setting an installation cooldown for newly published versions.
