On this page

On October 29, 2026, Cursor published a security notice: malicious versions of Anthropic.claude-code — 2.1.312 and 2.1.313 for Windows and macOS — appeared on the Cursor VS Code Extension Marketplace. Cursor states these packages were not developed by Anthropic. The notice says other extensions from cursor.com/marketplace and Cursor's other listed product lines were not affected by this finding.

Window and what the notice describes

Cursor places the marketplace window between about 2:27am PT and 1:35pm PT on October 29, 2026. Per the notice, the modified extension attempted to:

  • Collect and report host and user details (hostname, username, OS, architecture, home path, environment-variable names, working directories, configured Git email, public IP).
  • Add an attacker-controlled SSH public key to authorized_keys under the label svc-telemetry, enable the local SSH service, and open a reverse SSH tunnel.
  • Persist the reverse tunnel via a LaunchAgent on macOS or a scheduled task／Startup-script path on Windows, with background scripts retrying the tunnel roughly every 60 seconds.

What Cursor says was affected

Cursor says the attacker server is offline after work with the cloud host, so reverse-shell and host-detail POST paths described in the notice are no longer functional. Cursor also writes it has no evidence that other extension versions or the official distribution were affected.

Enabling the local SSH service needs administrator rights. On most macOS and Windows hosts the malicious extension would not have those rights, so that step fails and tunnel login would not succeed. Even so, Cursor says the extension may still have written the attacker's key, installed persistence, and sent host details — so hosts in the window still need the notice's checks. Uninstalling the extension alone may not be enough, because the payload can leave standalone persistence scripts.

What Cursor says it did

Cursor removed the malicious versions, blocked further distribution, briefly shut down the whole marketplace out of caution, audited access and reported no other extensions were tampered with, rotated keys, rebuilt the marketplace, and restored it. IOCs (VSIX hashes, payload markers, network endpoints, persistence paths) and remediation scripts (remediate-macos.sh, remediate-windows.ps1) are in the notice; Cursor updated IOCs on October 30, 2026, 11:30am PT. Contact listed: security@cursor.com.

Hosts that installed or updated to 2.1.312／2.1.313 from that marketplace in the window should follow Cursor's steps: run the published check／remediation scripts, search telemetry for the listed IOCs (including the svc-telemetry key comment), isolate affected hosts, remove unauthorized keys／persistence／tunnel processes, and rotate reachable credentials from a trusted system. Full hashes and paths are in Cursor's notice; this page doesn't expand the full IOC table.

Not the npm channel

This incident is a Cursor VS Code Extension Marketplace distribution issue. It is not the same channel as npm @anthropic-ai/claude-code. DigIntoAI's existing short note Claude Code 2.1.312 Adds OIDC user_id_claim and Safer Large-File Writes covers a legitimate npm feature release and must not be read as the same event as these malicious marketplace builds.

Details follow Cursor's notice; for reference only.

Related reading: Aokigahara Infostealer Targets Claude, Codex, Cursor and Copilot Credentials; OpenCode Says a Security Incident Hit About 1.4% of Console Users.