Here's my hot take: the scariest AI story of the week isn't about a chatbot saying something weird. It's about a malicious Claude Code extension that sat in Cursor's extension marketplace for roughly eleven hours and tried to plant a backdoor on developers' machines. If you write code with AI tools, this one's about you, and I think it deserves way more attention than it's getting.
Cursor, the AI coding editor that's now owned by SpaceX, published a security notice saying a tampered copy of Anthropic's Claude Code extension was live in its marketplace on Thursday, October 29. According to Reuters, up to 5,000 users may have installed it. Anthropic didn't build it. Somebody else did, and they had very specific plans for your laptop.
What the malicious Claude Code extension actually did
The bad builds were versions 2.1.312 and 2.1.313 of the extension, for Windows and macOS. They were available from about 2:27am to 1:35pm Pacific time on October 29. That's a long workday's worth of exposure in a place developers generally trust.
Once it loaded, the code went to work. Cursor says it grabbed host and user details like your hostname, username, OS, home directory path, the names of your environment variables, your configured Git email and your public IP. Then it tried to add an attacker-controlled SSH key to your authorized_keys file, switch on the local SSH service and open a reverse SSH tunnel back to the attacker.
It also tried to stick around. On a Mac, it set up a LaunchAgent. On Windows, it attempted a scheduled task running as SYSTEM, with a Startup-script fallback if that didn't work. Background scripts kept retrying the tunnel about every 60 seconds. That's not a sloppy prank. That's someone who wanted long-term access to developer machines.
Microsoft's threat intelligence team dug into the injected JavaScript too, and its write-up on the Microsoft Security Blog is worth a read if you like the gory details. The key line for me: the loader may still write keys and persistence artifacts even when the tunnel itself fails.
The good news (sort of)
There's some genuine relief here. Turning on the local SSH service needs admin rights, and the extension didn't have them on most Mac and Windows machines. Cursor says that step would have failed unless you'd launched the editor with administrator privileges, partly thanks to bugs in the attacker's own code. Hackers writing buggy code? Shocking, I know.
Cursor also says it worked with the cloud host to take the attacker's server offline, so the reverse tunnel and the data upload no longer function. The company pulled the bad version, shut down the whole marketplace as a precaution, rotated its keys, rebuilt the marketplace and brought it back. It says it audited access and found no other tampered extensions.
Microsoft adds a useful bit of scope: the bad packages never showed up on Microsoft's own Visual Studio Marketplace or on npm, and Anthropic told Microsoft its systems weren't compromised. So this looks like a Cursor marketplace problem, not a Claude Code problem.
But "the attacker probably couldn't log in" isn't the same as "nothing happened." Your machine details may already be sitting on someone's server. And the persistence scripts don't vanish just because the server did.
Should you care about this malicious Claude Code extension?
If you use Cursor on a Mac or Windows PC and you installed or updated the Claude Code extension on October 29, yes. Drop what you're doing. Cursor is blunt that simply uninstalling the extension may not be enough, because the payload leaves behind standalone scripts that keep running. Here's the short version of what the company recommends:
- Run the check script Cursor attached to its notice to see whether you're affected.
- Look through your endpoint, network and extension-install logs for the indicators Cursor lists.
- Isolate any machine that shows signs the payload ran.
- Remove the rogue SSH key, the persistence items and any running tunnel processes, then decide whether the machine needs a full rebuild.
- Rotate credentials and sessions that were reachable from that machine, and do it from a different, trusted computer.
That last step matters more than it looks. The extension only collected the names of environment variables, not their values. Cursor notes, though, that this doesn't rule out credentials being grabbed later through the backdoor if it ever worked. If you keep cloud keys or tokens in your shell, I'd rotate them and sleep better.
If you use Claude Code straight from Anthropic, or you didn't touch the extension that day, you're outside the scope Cursor described. You can relax. Mostly.
The bigger problem nobody wants to talk about
Here's where I get a little preachy. AI coding tools are amazing, and I use them constantly. But we've collectively decided to give them enormous trust. They read our repos, run terminal commands and touch our credentials. Then we install add-ons for them from marketplaces with barely a second thought.
Attackers have noticed. An extension with a famous brand name on it is the perfect disguise, because nobody double-checks the thing they install every week. Developer machines are juicy targets too. One compromised laptop can mean access to source code, production servers and cloud accounts.
Cursor hasn't said how the bad package got published in the first place, whether through its own infrastructure or a stolen publisher credential. That's the part I really want answered. Without it, it's hard to know whether this was a one-off or a sign of a deeper hole. The Verge's coverage notes Cursor confirmed no other extensions were tampered with, which is good, but "how did this happen?" still deserves a public answer.
My personal rule going forward is boring but effective. I'll pin extension versions where I can, avoid auto-updating anything that runs with access to my terminal, and grab big-name tools from the vendor's own channel when that's an option. It's a little more friction. I'll take friction over a stranger's SSH key in my home folder.
FAQ
Which versions of the Claude Code extension were malicious?
Versions 2.1.312 and 2.1.313 of Anthropic.claude-code, served through Cursor's VS Code extension marketplace for Windows and macOS on October 29, 2026.
Was Anthropic hacked?
No evidence of that. Cursor says the malicious versions weren't developed by Anthropic, and Microsoft says Anthropic confirmed its systems weren't compromised.
Is uninstalling the extension enough?
Probably not. Cursor warns the payload drops standalone persistence scripts, so you should run its check script and clean up the SSH key and startup items too.
Are other Cursor extensions affected?
Cursor says it audited access and found no other tampered extensions in its marketplace.
So be honest with me: how many extensions are running inside your code editor right now, and when did you last check where any of them came from?
0 Comments