News · 2026-10-31

Malicious Claude Code copies in Cursor’s marketplace tried to plant an SSH backdoor

Tampered and counterfeit Claude Code extensions distributed through Cursor’s marketplace attempted to install persistent remote access on developer computers on October 29. Cursor identifies two affected versions and an approximately eleven-hour exposure window; the evidence places the malicious packages in Cursor’s delivery channel and does not establish that Anthropic’s own systems or the upstream extension stores were compromised.

Key facts

• Cursor lists malicious packages labeled 2.1.312 and 2.1.313 for macOS and Windows.
• The availability window was approximately 2:27 a.m. to 1:35 p.m. Pacific time on October 29, about 11 hours and 8 minutes.
• The loader attempted reconnaissance, unauthorized key placement, remote-access tunneling, and persistence.
• The primary incident record is Cursor’s security notice, with independent technical analysis from Microsoft and Phorion.

The familiar publisher name was part of the danger. Developers saw an extension presented as Claude Code inside their normal editor workflow. But a recognizable name and a plausible version do not establish that the downloaded files came unchanged from the named publisher.

Cursor’s extension documentation explains that the editor uses its own marketplace proxy over Open VSX, an upstream registry. Those are separate parts of the distribution chain. Phorion’s corrected advisory explicitly names “Cursor Marketplace.” Microsoft’s analysis and Anthropic maintainer Dan Dworken’s statements in the Hacker News discussion likewise distinguish Cursor’s channel from Open VSX, Microsoft’s marketplace, and Anthropic’s official package.

The two version labels also conceal different histories. Anthropic really released 2.1.312; the affected Cursor artifact was a modified copy. Anthropic staff said 2.1.313 was not an official release on the named upstream channels. The important identifier is therefore the artifact and its delivery path, checked against Cursor’s published hashes, rather than a version number considered alone.

The attack did not need a user to ask an AI model anything dangerous. The injected code ran when the extension module loaded. According to Microsoft and Phorion’s code analysis, it collected host information, selected environment-variable names associated with sensitive services, attempted to add an attacker-controlled login key, and arranged repeat attempts at an outbound remote-access connection.

Think of the marketplace as a delivery service bringing a tool into a workshop. The label on the box identifies the tool the developer expected. The substituted contents can act with the workshop owner’s existing permissions before anyone uses the tool for its intended job. Here, ordinary access to source code, local configuration, credentials, and developer utilities made the editor process a valuable place to run malicious software.

The remote-access mechanism used Secure Shell, commonly called SSH. An outbound tunnel can provide a route back to a machine that would otherwise reject unsolicited incoming connections. But attempting that route is different from creating a usable attacker login. Local SSH configuration, administrator privileges, server settings, and implementation errors constrained whether the attempted foothold worked.

That distinction is the strongest limit on the alarming headlines. Microsoft says the initial beacon contained variable names rather than their values. Phorion documents platform-specific failures, and neither technical analysis establishes a working login on every affected computer. Cursor publishes no installation total. The widely repeated estimate of up to 5,000 exposed developers comes from secondary reporting and should not become a confirmed victim count.

Cursor says it removed the packages, audited and rebuilt its marketplace, rotated marketplace keys, and helped disable the attacker’s server. Those steps stop distribution and disrupt the known connection endpoint. They do not automatically remove files or keys already written on a workstation. Cursor warns that uninstallation may be insufficient; Microsoft recommends examining installation history alongside process, network, authentication, and persistence evidence.

For teams, the immediate task is to determine whether the affected artifact actually arrived through the affected channel, then follow the vendors’ host-investigation guidance. Credential rotation and rebuilding decisions should reflect exposure and the ability to restore trust in the machine. A familiar extension identifier is useful inventory data, but it is weak evidence of provenance.

Cursor also documents optional signature verification and install cooldowns. A delay can reduce exposure to a short-lived malicious update, while verification checks a different part of artifact provenance. The reviewed record does not establish whether those controls were enabled or why this package passed marketplace analysis.

The broader lesson extends beyond prompt injection: an AI tool can be compromised as ordinary executable software. Sandboxing and scoped credentials address consequences of execution, while distribution controls address what code arrives. The incident demonstrates why all those boundaries matter, even when the model itself follows its instructions perfectly.

Primary source, verified: read the paper →

Ground Truth. (2026, October 31). Malicious Claude Code copies in Cursor’s marketplace tried to plant an SSH backdoor. Ground Truth. https://groundtruth.day/news/cursor-marketplace-claude-extension-backdoor.html

@misc{groundtruth:cursor-marketplace-claude-extension-backdoor,
  title  = {Malicious Claude Code copies in Cursor’s marketplace tried to plant an SSH backdoor},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/cursor-marketplace-claude-extension-backdoor.html}
}

Topics: cybersecurity · ai-security · supply-chain · coding-agents · cursor · endpoint-security