Cursor Warns of Tampered Claude Code Extensions in Two Versions
Cursor has warned that tampered copies of the Claude Code extension were distributed through its extension marketplace on 29 October. Its security notice, updated on 30 October, identifies versions 2.1.312 and 2.1.313 for macOS and Windows. Teams investigating the incident should check both versions and where each copy came from.
The malicious builds attempted to establish persistent SSH access to developer machines. Cursor says the remote-access step would generally fail unless the editor had administrator privileges, but other changes and host-information reporting could still have occurred. Removing an extension therefore does not settle whether the machine is safe.
Check the marketplace as well as the version
Cursor places the distribution window between approximately 02:27 and 13:35 Pacific Time on 29 October, equivalent to 09:27 to 20:35 UTC. Its current warning covers the Anthropic.claude-code packages obtained through the Cursor VS Code Extension Marketplace during that period.
That scope is broader than the initial focus on 2.1.313 in StepSecurity’s 30 October research report. Cursor marks its own update at 11:30 Pacific Time on 30 October and says it clarified the affected versions and indicators. Use that updated version list when deciding which installations need investigation.
A version number alone can conceal an important difference. StepSecurity reports analysing a clean 2.1.312 package from Open VSX, while Cursor now identifies malicious 2.1.312 packages in its own marketplace. Those statements concern different distributed artefacts. A clean copy from one registry cannot clear a same-numbered copy obtained through another route.
In a public clarification linked by the researchers, Anthropic’s Felix Rieseberg said the incident did not compromise Anthropic’s systems or employee laptops and that Anthropic neither built nor published the tampered copy. In a separate comment, David Dworken said 2.1.313 was never released through Open VSX, Microsoft’s Visual Studio Marketplace or Anthropic’s official hosts. He said Anthropic numbered its next update 2.1.314 to distinguish it from the malicious build.
StepSecurity has corrected its earlier description of Open VSX as the source and its implication that Microsoft had removed the build. The current evidence points to tampering in the Cursor distribution route. It does not establish a compromise of every Claude Code installation or every editor that can use the extension.
What the sample did, and what could fail
StepSecurity says its sandbox analysis found a loader embedded in the extension’s JavaScript bundle. Loading the module was enough to start the payload, without a Claude conversation or package-installation hook. The researchers observed host reconnaissance, an added SSH key, persistence and a reverse SSH connection. Those are findings from analysis of the sample, rather than a measurement of every recipient’s machine.
Cursor supplies an important operational limit: enabling the local SSH service required privileges the extension usually lacked, and errors in the malicious code also impeded access. Its notice nevertheless says the payload added the key, installed persistence and sent host details. The distinction matters when triaging a device. A failed remote login can coexist with unwanted code execution and lasting changes.
The reported reconnaissance included host and user information and environment variable names. Names are not the same as secret values. The sources do not establish that every developer’s tokens, source code or conversations were stolen. Investigators should assess what the process could reach and whether any subsequent access occurred, rather than assume either complete theft or complete safety.
Distribution estimates are not a victim count
StepSecurity attributes an upper estimate of 5,000 recipients to Cursor. The current Cursor notice examined for this report does not repeat that number. It should therefore remain an attributed distribution estimate, without being presented as an independently confirmed count of compromised hosts.
The reviewed sources do not quantify how many installations loaded the payload, successfully opened a usable tunnel, or suffered follow-on intrusion. Nor does the sample’s inclusion of Linux-related logic establish that malicious Linux packages were distributed: Cursor’s affected-package warning names macOS and Windows. The defensible urgency is that a known malicious extension reached a legitimate delivery channel and may have left changes behind.
Containment does not verify host recovery
Cursor says it removed the malicious packages, shut down and rebuilt the marketplace, rotated keys and returned the service to operation. It also says the hosting provider disabled the attacker’s server. These measures address the identified delivery and connection infrastructure. They do not remove a key or persistence script already written to a developer’s computer.
For an affected fleet, start by preserving installation history and available endpoint evidence. Record the extension version, platform, installation or update time and distribution source. An inventory that only shows the currently installed version can miss a machine that received a malicious package and subsequently upgraded or uninstalled it.
Cursor’s notice contains the complete package hashes, indicators and platform-specific remediation guidance. Useful investigation pivots include:
- The SSH key comment
svc-telemetryin authorised-key files. - Connections or attempted connections to
134[.]209[.]82[.]225, the identified server, assessed against the incident timeline. - The macOS LaunchAgent
com.apple.sysmond, the Windows scheduled taskSysMonand related startup or configuration files described in the notice.
Interpret those findings in context. A matching key or payload is strong evidence to investigate; the absence of one file does not account for installation history, earlier removal or all subsequent activity. Cursor advises isolating machines that show payload execution or backdoor installation, removing the unauthorised access and persistence, and assessing whether rebuilding is necessary.
Rotate credentials and sessions accessible from affected machines using a trusted system, following the vendor’s incident guidance. Preserve evidence before destructive clean-up where practical. Reinstalling an authentic current extension is part of recovery, alongside checking the host and its identities. A successful extension update cannot by itself verify that the computer has been restored to a trustworthy state.
BlackTree’s Tensorlake incident analysis explains a related trust problem: a familiar package identity or legitimate build path does not establish safe code. These are separate incidents, and their affected distribution routes and recovery steps must be checked separately.
Sources: Cursor’s incident notice and 30 October update; StepSecurity’s original research and correction; the linked public statements from Anthropic staff.
