Eleven Hours on Cursor's Marketplace: The Trojanized Claude Code Extension and What It Says About AI Tooling

On Thursday, 29 October 2026, Cursor published a security notice that no developer wants to read before the first coffee. For roughly eleven hours that day, between about 2:27 am and 1:35 pm Pacific time (09:27 to 20:35 UTC), its VS Code Extension Marketplace served a maliciously modified copy of Anthropic’s official Claude Code extension, anthropic.claude-code, under Anthropic’s publisher name and with the next version numbers in line, 2.1.312 and 2.1.313, for macOS on Apple silicon and for Windows x64. Cursor puts the number of affected users at “at most 5,000”. The build was not made by Anthropic, and Anthropic says its own systems were not breached. Somebody with access to Cursor’s marketplace published it, and as of this writing neither company has said how.

Three independent teams have since examined the package: OpenSourceMalware, StepSecurity and Microsoft Threat Intelligence, with the macOS security firm Phorion credited with spotting it first. Their accounts agree on what the code was built to do. They also agree on something more uncomfortable: the extension kept working exactly as advertised, and the victim never had to type a word to Claude.

What was served, and where

The tampered package is the real extension in every respect but one. Its manifest, its README, its bundled binary and its icon are the originals. Only the main extension.js bundle differs: a short, self-contained block of code was placed in front of the legitimate bundle. StepSecurity measured the malicious file at 3,692,922 bytes, about 7 KB larger than the preceding clean release. There are no install-time package hooks, because none are needed. The added code runs the moment the editor loads the extension module, before the extension’s own startup callback, so simply having the extension installed and the editor open was enough.

Where it came from took a day to settle. Early reports, including the first versions of several advisories, blamed Open VSX, the Eclipse Foundation registry that Cursor, Windsurf and VSCodium rely on because Microsoft’s Visual Studio Marketplace is licensed only for Microsoft’s own products. That turned out to be wrong. OpenSourceMalware, after talking to Cursor’s security team, describes Cursor’s marketplace as an internal service that pulls packages from Open VSX, manages a set of its own extensions, decides per request which source to serve from, and delivers files through a Cursor CDN. The malicious builds lived only in that service. Anthropic confirmed to StepSecurity that 2.1.313 was never published to Open VSX, to Microsoft’s marketplace or to any of its own channels, and that it skipped straight to 2.1.314 to avoid confusion. Microsoft separately confirmed that neither its marketplace nor the npm package was affected.

One detail matters for anyone who pins versions. Cursor’s updated notice, from 30 October, lists a malicious 2.1.312 as well. Open VSX also carries a 2.1.312, and StepSecurity downloaded and verified that copy clean. Same publisher, same version string, different bytes. A version number was never a guarantee of identity, and this incident makes that concrete.

What the payload was built to do

Cursor’s notice, Microsoft’s analysis and OpenSourceMalware’s report describe the same goal: long-term interactive access to developer machines. On load, the code gathered basic host and user details, including the configured Git email, the public IP address and the names, not the values, of environment variables that look like keys, tokens or cloud credentials. It then appended an attacker-controlled SSH public key to the user’s authorized keys, tried to switch on the local SSH service, tried to open an outbound reverse tunnel to a server the attacker controlled, and registered startup entries on macOS, Linux and Windows so the tunnel would come back after a reboot. Finally it posted the collected details to that server. The loader downloaded no second-stage program, and it swallowed its own errors so that the editor and the extension looked normal throughout.

Microsoft’s analysts note that the startup entries were given names resembling system monitoring components, and that an artifact on disk does not by itself prove the corresponding step succeeded. That caveat cuts both ways: a machine can carry the planted key and the persistence files without the attacker ever having logged in, and it can also look clean after an update while those files are still there.

Why the damage was smaller than designed

The attack had a flaw. Cursor states, and Phorion’s analysis agrees, that turning on the SSH service requires administrator rights that the extension does not have on most macOS and Windows machines, and that a mistake in how the code handled that case meant the step was skipped rather than retried. Without a running SSH service on the victim’s side, the reverse tunnel had nothing to forward to, so on most hosts the attacker could not log in. Cursor also worked with the hosting provider to take the attacker’s server offline, which stopped both the tunnel and the reporting.

Phorion’s chief executive, Calum Hall, quoted by Help Net Security, is careful not to call this a defence. A Mac on which Remote Login was already enabled, or is enabled later, has a ready-to-use backdoor. And on every affected machine the key, the persistence and the reconnaissance report still landed. Cursor’s own advice is to remediate regardless of whether the tunnel ever worked.

Who is responsible, and what nobody has said

Within a day, prominent voices in the security community were suggesting that Anthropic itself had been breached. Felix Rieseberg of Anthropic’s technical staff replied on X, as reported by The Register: “We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users.” Microsoft says Anthropic gave it the same assurance.

Cursor’s side of the story is a list of actions rather than an explanation. It removed the builds, then shut down the entire marketplace “out of an abundance of caution”, audited access, found no other tampered extensions, rotated its keys, rebuilt the service and brought it back online. It says it will contact affected users. What it has not said is how an outsider obtained the ability to publish under Anthropic’s name, whether the attacker had broader access, or who the attacker was. OpenSourceMalware, which says Cursor confirmed a marketplace compromise to it directly, draws its own inference: “You don’t rebuild a whole service unless there is a deeper problem.” That is an inference, not a disclosure. Forever Security, which is maintaining a live page on the incident, notes that beyond Rieseberg’s post it could find no formal statement from Anthropic, and OpenSourceMalware reports that the Claude Code extension had not yet returned to Cursor’s marketplace when it published.

OpenSourceMalware frames the question that will outlast this incident: “A manifest claiming to be Anthropic is not equivalent to a release authorized by Anthropic. Who is allowed to publish as Anthropic?”

Why this matters beyond 5,000 laptops

Auto-update was the delivery mechanism. The build carried the official extension ID and the next version number, so editors fetched it without anyone clicking anything. Every convenience that keeps tooling current is also a channel that moves a bad build to thousands of machines in minutes.
Version strings are labels, not identities. Two artifacts called 2.1.312 existed, one clean and one not. Only a content hash distinguishes them. Lockfiles and pinned versions help against upgrades, not against substitution.
Marketplaces that mirror other registries inherit the publisher’s trust without necessarily inheriting the publisher’s authentication. The editor forks that cannot use Microsoft’s store have built their own distribution paths, and each path is a new place where “who may publish as X” has to be answered.
The AI toolchain is now the target. This landed one week after a backdoored LiteLLM 1.107.0 went out through that project’s own signed pipeline, and on the same day that Forever Security published its EMBRACE research showing that the browsers embedded in Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop had each been given powers an ordinary browser withholds, with the Codex and VS Code issues still unpatched. Three stories in ten days, three different weaknesses, one common thread: AI developer tools run with a developer’s full credentials, and attackers have noticed.

Microsoft’s guidance for organisations that use Cursor is practical: restrict extensions to approved publishers, and configure an installation cooldown so newly published versions are not installed for a set period. A cooldown of even a day would have kept this build off most machines.

If you use Cursor

Cursor’s notice is the reference. If a machine installed or updated the Claude Code extension from Cursor’s marketplace during the window on 29 October, check the user’s SSH authorized keys for an entry labelled svc-telemetry. If it is present, treat the machine as compromised: isolate it, keep evidence, run Cursor’s remediation script for your platform, and then confirm nothing listed in the notice remains. Updating to 2.1.314 or uninstalling the extension does not remove the planted key or the startup entries. Rotate every credential reachable from that machine from a clean system, and review SSH and authentication logs from 29 October onward for logins that used the planted key.

Open questions

The entry point is the big one. Until Cursor explains how a tampered build reached its marketplace under Anthropic’s publisher name, nobody outside the company can judge whether the fix is complete or whether other extensions could be substituted the same way. The count of 5,000 is Cursor’s upper bound, not a count of machines on which the code actually ran. No one has said whether any tunnel was ever used. And the question OpenSourceMalware raised, who is allowed to publish as Anthropic, applies with equal force to every other publisher on every marketplace that developers’ editors quietly poll for updates.