BUSINESSDevelopments · · Source: Cursor
Cursor: tampered Claude Code extension tried to plant a backdoor
For about eleven hours on October 29, 2026, a tampered version of the Claude Code extension was available in the marketplace of the AI code editor Cursor. Cursor says at most 5,000 people installed it; the version wasn't built by Anthropic and tried to set up a persistent backdoor.
What happened
- Version: anthropic.claude-code 2.1.313, in Cursor's marketplace only.
- Window: October 29, from about 2:27 am to 1:35 pm Pacific time.
- Affected: at most 5,000 users, according to Cursor, which says it will contact them directly. With auto-update on, you may have received it without doing anything.
- Status: the version has been removed. According to The Hacker News, there's no evidence it reached Open VSX or Microsoft's marketplace.
How the tampered version got into the marketplace isn't known yet. Researchers at OpenSourceMalware discovered it.
What the malware does
It sends details about the machine to the attackers, including the username, Git email and the names (not values) of environment variables that look like keys or passwords. It also adds a foreign SSH key labelled “svc-telemetry” and sets up persistence that retries a connection about every 60 seconds. Cursor says missing admin rights usually block the tunnel itself, but the key and persistence still land on most machines.
How to check
- Search
~/.ssh/authorized_keys(on Windows:%USERPROFILE%\.ssh\authorized_keysandC:\ProgramData\ssh\administrators_authorized_keys) for “svc-telemetry”. - If it's there, treat the machine as affected: isolate it and run the remediation scripts from Cursor's notice.
- Cursor says uninstalling may not be enough. Consider rebuilding the machine.
- From a clean device, rotate all credentials and sessions that machine could reach.
What this means for you
- If you use Cursor with Claude Code, check for the SSH entry today. It takes a minute.
- Auto-updates are normally a good idea; here they were the way in. On company machines, an approved list of extensions is worth having.
- AI coding tools run with broad permissions on your machine. They belong in the same security review as any other software.
Luigi's take
This also affects people who don't think of themselves as developers. More and more marketers and freelancers use AI editors to build small scripts and automations. Often that happens on the same work machine that holds everything else: customer data, ad accounts, passwords in files.
My advice for small teams: separate what AI tools can reach from what's really valuable. No access keys in plain-text files, use a password manager, and wherever possible create access with limited rights. That's no reason to give up AI tools. But if you use them, know that an extension can in principle do whatever you can do.
Source
Cursor: Claude Code extension security notice
More sources
- The Hacker News – Technische Details, Entdeckung durch OpenSourceMalware
This article was researched and written with AI assistance. Responsible: Luigi Lugmayr.
