A Poisoned Claude Extension Hit Cursor Users. The Malware’s Own Bugs Saved Most

For about 11 hours on Thursday, anyone who installed or auto-updated Anthropic’s Claude Code extension inside the Cursor code editor could have pulled down a tampered copy that planted an attacker’s key on their machine. Cursor says the poisoned versions reached “at most 5,000 users.” The good news is that the malware was badly written. The bad news is that nobody has publicly explained how it got into an official listing in the first place.

This is the kind of attack security people have warned about for years: you don’t break into thousands of developer laptops one at a time, you poison the thing they all update automatically. It just happened to land on one of the most popular AI coding tools, wearing the name of one of the most popular AI coding assistants.

What happened, according to the people who found it

Cursor posted its security notice on Oct. 29. It says a “maliciously modified version of Anthropic’s Claude Code extension” was available in the Cursor VS Code Extension Marketplace between about 2:27 a.m. and 1:35 p.m. Pacific that day, and that the malicious versions “were not developed by Anthropic.” That window works out to roughly 11 hours and 8 minutes. The security firm Sophos puts it at 09:27 to 20:35 UTC, which is the same window.

The first researchers to spot it were at Phorion, a Mac-focused detection company, after the extension tripped alarms on a customer’s Mac, its CEO Calum Hall told Wired. “Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker,” Hall said. Phorion’s technical write-up is the most detailed public analysis of the payload, and Microsoft Threat Intelligence published its own breakdown on Oct. 30.

The version story shifted as the investigation went on. Early reports, including Ars Technica’s, named only version 2.1.313. Cursor updated its notice at 11:30 a.m. PT on Oct. 30 to list 2.1.312 as well, and Phorion revised its advisory on Oct. 31 to match. If you checked yourself on Thursday night using the first version number you saw, check again.

The 5,000 figure comes from Cursor, as reported by Wired and Ars. It is an upper bound (“at most”), not a count of confirmed infections, and Cursor hasn’t said how many machines actually ran the payload.

How the backdoor was supposed to work

According to Phorion, the attacker didn’t rewrite Claude Code. They prepended a small block of JavaScript to the top of the extension’s main file. Because it sat at the top, it ran the moment the editor loaded the extension, before the real extension code started. The user didn’t have to click anything, and the real extension kept working normally afterward, which Microsoft notes helped avoid “alerting users.”

Here is the chain as Cursor, Phorion and Microsoft describe it:

1. Plant a key. It appended an attacker-controlled SSH public key, labeled svc-telemetry, to the user’s ~/.ssh/authorized_keys file. SSH (Secure Shell) is the standard tool for logging into a computer remotely, and that file is the list of keys allowed to log in as you without a password.
2. Try to turn on remote login. On Linux it tried to start the SSH service, on macOS it checked whether Remote Login was off and tried to switch it on, and on Windows it tried to install and start OpenSSH Server.
3. Dig a tunnel out. It opened an outbound SSH connection to a server at 134.209.82.225 and asked that server to forward traffic back to the victim’s own SSH port. This is a reverse tunnel: instead of the attacker knocking on your door (which a firewall or home router would usually block), your machine calls out and holds a door open from the inside.
4. Stay put. It installed persistence so the tunnel would come back after a reboot: a LaunchAgent named com.apple.sysmond on macOS (dressed up to look like an Apple component), an @reboot cron job on Linux, and a scheduled task called SysMon on Windows with a Startup-folder fallback. Background scripts retried the tunnel about every 60 seconds.
5. Phone home. It sent a one-time report with the hostname, username, operating system, home and working folders, Git email address, public IP address, and up to 40 environment variable names matching words like KEY, TOKEN, SECRET, PASS, AWS and GCP.

That last step is subtler than it looks. Phorion points out that the beacon sent the names of those variables, not their values. The attacker wasn’t stealing your AWS key yet. They were building a shopping list of which machines had which cloud credentials, so they could decide whose tunnel to walk through first.

Saved by sloppy code, mostly

Cursor says that outside “highly unusual circumstances where Cursor was started with administrator privileges,” the step that turns on the local SSH service failed “due to errors in the malicious code.” Without SSH running, the tunnel leads to a closed door, and the attacker can’t log in through it.

Phorion found the specific bugs. On macOS, the script ran systemsetup -getremotelogin without administrator rights. Instead of answering “Off,” macOS prints an “administrator access” error and exits as if nothing went wrong. The script only tried to enable Remote Login if it saw the word “Off,” so it skipped that step entirely. On Windows, Phorion says the code passed its PowerShell setup command through a helper that hardcodes /bin/sh, a Unix shell that a normal Windows machine doesn’t have.

The catch: “mostly” is carrying weight here. If a Mac already had Remote Login switched on, or the user turns it on later, Phorion says “the backdoor is ready and waiting,” because the attacker’s key is already in place. And Cursor is blunt that the key, the persistence scripts and the host report all landed regardless of the bug. Cursor also says it worked with the hosting provider to take the attacker’s server offline, so the tunnel and beacon no longer reach anything. That removes the live threat from this server, but not the leftover files on affected machines.

Mac, Windows, and the Linux question

Cursor’s notice says the affected packages were for Windows and macOS, and it lists file hashes only for Apple Silicon Mac and 64-bit Windows builds. But the payload itself contains Linux code, and Cursor’s own list of indicators includes Linux file paths and the Linux cron entry. Phorion says the implant “drops a persistent SSH backdoor across macOS, Linux, and Windows,” and Wired’s report describes a malicious extension “for Windows, macOS, and Linux.”

Our read: the most likely explanation is that the Linux code was present but no Linux build of the tampered extension was published, which is consistent with Cursor’s hash list. We don’t know that for sure, and neither company has said so. Linux users who updated Claude Code in Cursor on Thursday should run the same checks rather than assume they’re clear. There’s also a nasty bonus bug on Linux: Phorion says a flaw in the script’s crontab check “can wipe existing user cron jobs on repeat runs,” so an infected Linux box may have lost its own scheduled tasks too.

Whose account was it?

This is the biggest open question, and the two companies’ framing differs. Ars, citing independent researcher Kevin Beaumont and Phorion’s CTO Luke Roberts, reported that the malicious version was distributed through Anthropic’s official account on Cursor. “It was a supply-chain compromise where the attacker gained access to the official distribution channel,” Roberts told Ars.

Anthropic says it wasn’t its systems. Felix Rieseberg, a member of Anthropic’s technical staff, posted on X, as quoted by Wired: “it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish.” Microsoft says Anthropic confirmed the same to it, and that the malicious packages “were never published nor distributed” through Microsoft’s own Visual Studio Marketplace or npm.

Cursor’s notice says what it did afterward: it pulled the versions, shut the whole marketplace down, audited access, confirmed no other extensions were tampered with, “rotated our keys,” rebuilt the marketplace and brought it back. Rotating keys is standard cleanup, so on its own it doesn’t tell us where the hole was. Cursor did not answer Wired’s question about whether the upload resulted from a breach at Cursor, and neither company answered Ars’s questions about how it happened.

That matters for everyone who uses a marketplace like this. If a publisher’s credentials were stolen, the lesson is about how publishers protect their tokens. If the marketplace itself let someone push a package under a verified name, the lesson is about the marketplace. Users can’t tell which risk they’re carrying until someone says.

This isn’t the first poisoned editor extension, but the target is new

Developer tools have been a favorite supply-chain target for a while, because developers’ machines hold source code, cloud keys and publishing rights. Two 2025 incidents make useful comparisons:

• GlassWorm (October 2025). Koi Security reported malware hidden in invisible Unicode characters inside extensions on Open VSX, the open-source extension registry used by several VS Code-based editors, with one also found on Microsoft’s marketplace. The Eclipse Foundation, which runs Open VSX, said leaked publisher tokens were abused and disputed Koi’s 35,800-install figure as inflated by bots.
• Nx “s1ngularity” (August 2025). Malicious versions of the popular Nx build tool were published to npm and, as Wiz and Snyk documented, tried to use locally installed AI command-line tools, including Claude’s, to hunt for secrets.

What’s different this time is the costume. GlassWorm mostly rode on small, obscure extensions. This attacker shipped a copy of a flagship AI coding assistant under its real name, in a marketplace run by a major AI editor, to people who had already chosen to trust it. In Nx’s case, attackers abused AI tools already on the machine; here, the AI tool itself was the delivery vehicle. And unlike GlassWorm’s stealthier design, Microsoft says this payload used only built-in system tools and no extra downloaded programs, which can make it quieter for some security tools, though the files it leaves behind are easy to search for once you know the indicators.

Why auto-update made this worse

Roberts told Ars that the malicious version “effectively superseded” the real one and that “extensions auto-update in Cursor by default.” That’s the uncomfortable trade at the heart of modern software: automatic updates are the best defense against old, unpatched bugs, and also the fastest way to spread a poisoned release. In this case, a user didn’t have to make a single bad decision. They only had to have the extension installed and their editor open on Thursday.

It also shows why AI coding assistants are high-value targets. They run inside the editor with the same permissions as the person using it, they sit next to source code and credentials all day, and they update often enough that one more version doesn’t raise eyebrows.

If you use Cursor, check this now

If you installed or updated Claude Code in Cursor on Oct. 29, Cursor’s notice has a one-line check for macOS and a PowerShell check for Windows. Both look for the svc-telemetry key in your SSH authorized keys file. Phorion warns that the malware only checked for that label, not the key itself, so it’s worth matching the key fingerprints Cursor and Phorion publish as well.

Uninstalling or updating the extension isn’t enough. Cursor says the payload “drops standalone persistence scripts that keep running,” and recommends isolating affected machines, removing the key, the persistence files and any tunnel processes, considering a rebuild, and rotating credentials reachable from that machine from a different, trusted computer. Cursor has published cleanup scripts for macOS and Windows. Phorion adds a useful forensic tip: because attacker logins would arrive through the tunnel, they’d show up in SSH logs as coming from localhost using the svc-telemetry key.

The takeaway

Thousands of developers got lucky because an attacker didn’t test their own code on a normal, non-admin laptop. That’s not a security control, and nobody should plan around it. Watch for three things: Cursor’s explanation of how someone published under the Claude Code listing; whether Cursor follows up on the Linux question and the number of machines that actually ran the payload; and whether Cursor and other editor marketplaces respond with stronger checks on official listings, such as signed releases or a short delay before auto-updates go out. Until then, “verified publisher” means a little less than it did on Wednesday.

Disclosure: Cursor is owned by SpaceX, and Futureshock uses Grok Bot, which Cursor’s notice names among its SpaceXSI products and says was not affected by this incident.

Hype in. Signal out.

Image: Then-UK Technology Secretary Peter Kyle visits Anthropic in San Francisco, Oct. 25, 2024. Anthropic’s own systems were not compromised in this incident, the company says. Photo by Alecsandra Dragoi / Department for Science, Innovation and Technology, via Wikimedia Commons, CC BY 2.0; cropped to 16:9.