AI
“A malicious version of Anthropic's Claude Code extension was distributed through Cursor's marketplace on October 29, potentially exposing up to 5,000 developers to malware." (plus caption detail: ~11 hours availability, persistent SSH backdoors, collection of usernames/IP addresses/Git emails, Cursor's remediation steps, and that…”
Plain restatementOn 29 October 2026, a tampered build of the Anthropic.claude-code extension was available in Cursor's VS Code extension marketplace for roughly 11 hours; Cursor states at most 5,000 users were affected. The build attempted to install a persistent SSH backdoor and transmitted host and user information to an attacker server. Cursor removed it, took its marketplace offline, and worked to neutralize the attacker infrastructure.
This one checks out, with one piece of context missing. Cursor published a security notice confirming that a tampered copy of Anthropic's Claude Code extension sat in its own extension marketplace for about 11 hours on 29 October 2026, and said at most 5,000 users were affected. The malicious code collected details such as username, Git email and public IP address, planted an attacker's SSH key, and installed persistence on the machine. Cursor removed the package, temporarily took its marketplace offline, and worked with providers so that the attacker's server no longer functions. The post leaves out one thing Cursor said: because of errors in the malicious code, the step that would have given attackers actual remote access would fail on most Mac and Windows machines, unless Cursor was running with administrator rights. The key and the persistence were still installed and data was still sent out, so the cleanup advice in the post is correct: updating or uninstalling the extension does not remove what was already written to disk. Cursor's notice also names two affected versions, 2.1.312 and 2.1.313, not just one, and Anthropic has said its own systems were not breached and that copies from its official channels are unaffected.
A [drifted from the evidence:] malicious version of [drifted from the evidence:] Anthropic's Claude Code extension was [drifted from the evidence:] distributed through Cursor's marketplace [drifted from the evidence:] on October 29, potentially exposing up to 5,000 developers to malware." (plus caption detail: ~11 hours [drifted from the evidence:] availability, persistent SSH [drifted from the evidence:] backdoors, collection of usernames/IP addresses/Git emails, Cursor's remediation steps, and [drifted from the evidence:] that updating or uninstalling may not remove backdoors)
[added by the neutral restatement:] On 29 October 2026, a [added by the neutral restatement:] tampered build of [added by the neutral restatement:] the Anthropic.claude-code extension was [added by the neutral restatement:] available in Cursor's [added by the neutral restatement:] VS Code extension marketplace [added by the neutral restatement:] for roughly 11 hours; [added by the neutral restatement:] Cursor states at most 5,000 users were affected. The build attempted to install a persistent SSH [added by the neutral restatement:] backdoor and [added by the neutral restatement:] transmitted host and user information to an attacker server. Cursor removed it, took its marketplace offline, and worked to neutralize the attacker infrastructure.
Red-tinted words in the claim drifted from the evidence. Green-tinted words are what a neutral restatement needs.
The trace / claim to source
- A maliciously modified build of Anthropic's Claude Code extension was distributed through Cursor's VS Code extension marketplace on 29 October 2026. This is stated in Cursor's own security notice.
- The exposure window of roughly 11 hours is accurate: about 2:27am PT to 1:35pm PT, which is 11 hours and 8 minutes.
- The "up to 5,000" figure matches the source wording exactly. Cursor said at most 5,000 users were affected. The post's "potentially exposing up to" correctly preserves the ceiling framing.
- The SSH backdoor description is supported. Cursor said the extension runs code that attempts to install a persistent SSH backdoor, and that it added the attacker's SSH key, installed persistence, and sent host details to the attacker.
- The data-collection list is supported. Cursor's notice lists hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.
- Cursor's three response actions as described in the post are supported: removal, temporary marketplace shutdown, and work with providers that left the attacker server non-functional.
- The warning that updating or uninstalling may not eliminate the backdoor is supported by multiple independent analyses, as the SSH key and OS-level persistence are written to disk separately from the extension.
- The post's attribution line, "Source: Cursor", correctly identifies where the central facts and the 5,000 figure come from.
- The caption says the extension "attempted to install persistent SSH backdoors, allowing attackers to remotely access affected computers." Cursor's notice qualifies the remote-access step directly, saying that outside highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail, and adding that turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. A reader of the post would likely conclude attackers obtained working remote access to affected machines; on most machines they very likely did not. The attacker key, the persistence mechanism, and the data exfiltration did land regardless, so the gap narrows the severity rather than erasing the incident. BleepingComputer frames the residual risk precisely: the malware can still install its SSH keys, establish persistence, and attempt to create the reverse tunnel, but if the SSH server is not already running, the tunnel cannot provide access to the compromised machine.
- Scale conflation (minor): the post refers to "a malicious version", singular. Cursor's updated notice names two affected versions, 2.1.312 and 2.1.313 for Windows and macOS. Anyone checking only for 2.1.313 would miss part of the affected set. The post was published 30 October, the same day Cursor expanded the version list, so this reads as a version-scope gap rather than an alteration.
- How the attacker was able to publish under the legitimate `Anthropic.claude-code` publisher identity has not been explained in Cursor's public notice. The initial access path remains an open question in the public record.
- How many of the up-to-5,000 users actually executed the payload, as opposed to downloading or updating, is not stated. "At most 5,000" is a ceiling on exposure, not a count of compromised machines, and Cursor has not published a breakdown.
- Whether any affected host had an SSH server already running, which is the condition under which the reverse tunnel could have succeeded, is not quantified in any source found.
- The 5,000 figure originates solely with Cursor and has no independent verification mechanism available to outside parties.
Cursor's own security notice is the artifact of record and states the core facts the post asserts. Cursor said it identified a security incident involving Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and macOS, and that these malicious versions were not developed by Anthropic. Between about 2:27am PT and 1:35pm PT that day, a maliciously modified version of Anthropic's Claude Code extension was made available in the Cursor VS Code Extension Marketplace, running code that attempts to install a persistent SSH backdoor. On scale, Cursor stated that at most 5,000 users were affected and that it would reach out directly. On payload behaviour, Cursor's notice says the malicious code collects host and user information including hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP, and attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel, with Cursor noting that outside highly unusual circumstances where Cursor was started with administrator privileges, errors in the malicious code would make this step fail. Cursor's notice also states the extension added the attacker's SSH key, installed persistence, and sent host details to the attacker. On response, Cursor removed the malicious version from its marketplace immediately upon detection and blocked further distribution, and in a public post said it took down its extension marketplace that afternoon, worked with relevant providers to neutralize the malware, and reinstated the marketplace after confirming there is no further risk. Cursor's notice records that the attacker server no longer functions. On the post's final point, independent analyses confirm the persistence outlives the extension. Updating or uninstalling the extension does not remove SSH keys or persistence mechanisms already written to disk, so investigation and cleanup remain necessary after upgrading. Because the backdoor persists independently at the OS level, simply updating or uninstalling the extension will not remove the malicious artifacts. Anthropic has publicly bounded its own role: "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected, and this only impacts Cursor users." Scope is also bounded by distribution channel: the malicious update was distributed only through Cursor's marketplace, with no evidence that it reached Open VSX or Microsoft's official VS Code Marketplace.
Complete reasoning
The reply is formatted for pasting into the thread where the claim is circulating.