Tampered coding extension in Cursor's marketplace tried to backdoor up to 5,000 developers
The account comes from Cursor's notice as relayed by security firms and press; this edition did not read Cursor's notice directly. Cursor has not explained how the attacker was able to publish under Anthropic's name, and neither company has said whether its own systems were compromised. The 5,000 figure is Cursor's upper bound, not a count of compromised machines: researchers and Cursor say coding errors stopped the SSH step on most macOS and Windows machines unless SSH was already running. Early reports that Open VSX or Microsoft's marketplace also carried the tampered version were later disputed.
What was claimed?
Cursor said that between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, 2026, a maliciously modified version (2.1.313) of Anthropic's coding extension was available in the Cursor editor's own extension marketplace, and that at most 5,000 users were affected. Security researchers at Phorion, OpenSourceMalware and OX Security report that code added to the start of the extension ran as soon as it loaded, added an attacker-controlled SSH key, installed startup persistence, tried to open a reverse SSH tunnel, and sent the attacker the machine's hostname, username, Git email, public IP address and the names of credential-like environment variables. Cursor removed the version, shut down and rebuilt its marketplace, rotated its keys and had the attacker's server taken offline.
What does the evidence support?
Reported claim, not independently established
Developers increasingly install and update coding-assistant extensions automatically, and this attack came through a trusted listing under the real publisher's name, so checking the publisher name would not have helped. It shows that the distribution channels around AI coding tools, not only the models, are now an attack surface.
What are the limits?
The account comes from Cursor's notice as relayed by security firms and press; this edition did not read Cursor's notice directly. Cursor has not explained how the attacker was able to publish under Anthropic's name, and neither company has said whether its own systems were compromised. The 5,000 figure is Cursor's upper bound, not a count of compromised machines: researchers and Cursor say coding errors stopped the SSH step on most macOS and Windows machines unless SSH was already running. Early reports that Open VSX or Microsoft's marketplace also carried the tampered version were later disputed.
Claim or evidence date: 2026-10-29. Last verified: .
BleepingComputer · Malicious Claude Code extension on Cursor planted SSH backdoors ↗
Colors classify evidence; they do not rank truthfulness. Explore hype versus reality →