---
title: "Attackers Plant Backdoor in Claude Code Extension on Cursor’s Marketplace"
description: "Anthropic says its own systems weren’t breached, and neither company has said how the tampered version was posted under its name."
author: "rews desk"
published: 2026-10-30T21:09:54Z
modified: 2026-10-31T05:00:51Z
url: https://rews.cc/a/attackers-plant-backdoor-in-claude-code-extension-on-cursor--4f640a
language: en
tags: ["ai", "cybersecurity", "security", "tech"]
publisher: "Rews (https://rews.cc)"
---

# Attackers Plant Backdoor in Claude Code Extension on Cursor’s Marketplace

*Anthropic says its own systems weren’t breached, and neither company has said how the tampered version was posted under its name.*

By rews desk · October 30, 2026 · https://rews.cc/a/attackers-plant-backdoor-in-claude-code-extension-on-cursor--4f640a

## In brief

- A tampered Claude Code extension, version 2.1.313, was on Cursor’s marketplace for about 11 hours on Thursday
- Cursor says up to 5,000 users may have installed it, and the build tried to open an SSH backdoor
- Phorion’s CTO says the build went out through Anthropic’s official account. Anthropic says its systems weren’t breached
- Without admin rights on most Mac and Windows machines, the backdoor mostly failed, but it still sent the attacker host details
- Cursor pulled the build and shut down its marketplace. Users are told to install 2.1.314 and rotate their credentials

A tampered version of Anthropic’s Claude Code extension was available on Cursor’s extension marketplace for about 11 hours on Thursday, and as many as 5,000 developers may have installed it, Cursor said.

The malicious build, version 2.1.313, tried to add an attacker-controlled SSH key to a developer’s machine, turn on the local SSH service and open a reverse SSH tunnel to the attacker, according to Cursor’s disclosure. Cursor said the build was live from 2:27 a.m. to 1:35 p.m. Pacific time. Extensions in Cursor update automatically by default, so many users would have received it without clicking anything.

The code was written for Windows, macOS and Linux, [Ars Technica reported](https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/) on Friday. Cursor extensions run with the editor’s permissions, so an installed copy could likely reach local files, source code and developer tools.

The companies don’t agree on where the breach happened. Luke Roberts, the chief technology officer and a co-founder of the security firm Phorion, told Ars that the version came through Anthropic’s official account. “It was a supply-chain compromise where the attacker gained access to the official distribution channel,” he said. “The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312.” The independent researcher Kevin Beaumont also said the build went out through that account. Mr. Beaumont first wrote on his blog that [Anthropic had been hacked](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2?gi=652a1cfb5c50). He later updated the post to include Anthropic’s statement that the breach was on Cursor’s side.

Felix Rieseberg, a member of Anthropic’s technical staff, put the problem on Cursor. “We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops,” Mr. Rieseberg wrote on X, [The Register reported](https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682). He said “a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension,” one “which we didn’t build or publish,” and that “this only impacts Cursor users.”

Cursor agrees that Anthropic didn’t build it. It hasn’t said how someone else got the build listed under Anthropic’s name. As of Friday, Anthropic had sent customers no public notice of the incident, Ars reported.

The attack mostly failed. Turning on SSH requires administrator rights, and the extension doesn’t have them on most Mac and Windows machines, Cursor said, so on those machines the attacker couldn’t have logged in through the tunnel. The rest of the code still ran. It added the key, set itself up to survive restarts and sent the attacker host details, including usernames, Git email addresses and public IP addresses, according to [Phorion’s analysis as reported by Help Net Security](https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/). Phorion’s [own advisory](https://phorion.io/blog/offical-claude-code-vsx-compromise/) has the technical details.

Early reports didn’t agree on which marketplaces were hit. [StepSecurity wrote](https://www.stepsecurity.io/blog/claude-code-extension-trojanized) that the build had been published to Open VSX, the open-source extension registry, and copied from there into Cursor’s store. Cursor said only its own marketplace was affected.

Cursor said it pulled the version as soon as it found it and then shut down its VS Code marketplace “out of an abundance of caution.” It also rebuilt the marketplace, rotated its keys and worked with the hosting company to take the attacker’s server offline, [according to OX Security](https://www.ox.security/blog/malicious-claude-code-extension-cursor-ssh-backdoor/). According to Mr. Beaumont, Anthropic released version 2.1.314 several hours after the bad build appeared. Cursor said it had found no tampering in any other version and is telling users to install 2.1.314.

Removing the extension doesn’t remove the backdoor. The payload leaves separate persistence scripts on the machine. Cursor has published scripts that check for the backdoor and remove the SSH key and tunnel processes. Sophos advised anyone who installed the bad build to also rotate every credential the machine could reach. Cursor said it would contact the affected users directly.