Cursor Breach: Fake Claude Code Extension Drops SSH Backdoor

Cursor, the company behind the AI-powered code editor, says its extension marketplace served two maliciously modified builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313, to Windows and macOS users. According to the company, the two builds were available for roughly 11 hours on October 29, 2026, before they were pulled and the marketplace was temporarily taken offline.

How did the attack start?

In an update published on November 13, Cursor explained that it all began with an access key it had issued to a service provider called Fireworks, which leaked on the provider's side. The attacker used the key to copy data from a read-only cloud storage bucket holding old coding-session logs, some of which contained unredacted credentials. From there the attacker reached internal tools, then used stolen credentials to plant the malicious build directly in the cache that serves the extension marketplace.

Cursor stressed that Anthropic did not publish this build and that the upstream extension registry (Open VSX) never contained the malware. The company estimates that no more than 5,000 users may have received the tainted version.

What does the malicious extension do?

Based on Cursor's notice and an analysis by Microsoft Threat Intelligence, the injected code tries to:

• Collect device and user details, such as hostname, username, operating system and public IP address, and send them to the attacker.
• Add an attacker-controlled SSH key to authorized_keys, start the SSH service and open a reverse SSH tunnel.
• Install persistence (a LaunchAgent on macOS, a scheduled task on Windows) that retries the tunnel roughly every minute.

Cursor says starting the SSH service requires administrator rights, so that step likely fails on most machines, and the attacker's server has been shut down with the hosting provider's help. Even so, the extension may still have written the key and persistence files, and the company warns that simply uninstalling the extension may not be enough.

What should you do?

1. If you installed or updated the extension from the Cursor marketplace on October 29, run the detection script Cursor published in its official notice.
2. Remove any unfamiliar SSH keys from authorized_keys and delete suspicious scheduled tasks or LaunchAgent items.
3. From a separate, trusted device, rotate the passwords, keys and tokens the machine had access to.
4. Organizations: search endpoint and network logs for the published indicators of compromise, and isolate any machine that shows traces.

Cursor says the attacker's last observed activity was on November 1 and was blocked, and it considers the incident contained.