Tampered Claude Code extension served SSH backdoor to up to 5,000 Cursor users for 11 hours

For about 11 hours on 29 October 2026, Cursor's extension marketplace served a backdoored copy of the Claude Code extension that planted an attacker's SSH key, opened a reverse tunnel to a remote server, and reported each machine's hostname, username, Git email, public IP, and the names of up to 40 environment variables that looked like credentials. Versions 2.1.312 and 2.1.313 were affected on macOS and Windows; the same version numbers on Open VSX, Microsoft's Visual Studio Marketplace, and npm were clean and unaffected. Cursor puts the exposure at "at most 5,000 users."

The tampered build appeared under Anthropic's name in Cursor's marketplace, though Anthropic never made it. Cursor's marketplace proxies Open VSX but serves extensions under publisher names it controls; the attacker apparently uploaded through that channel. On most machines the backdoor's attempt to enable SSH failed for lack of admin rights, leaving the tunnel dormant but the planted key, startup scripts, and credential-name report in place. Updating or uninstalling the extension does not remove those artifacts. Cursor has not said how the attacker accessed its marketplace, and no one has been named. The incident overlaps in time with a reported Binance hot-wallet theft whose initial disclosure mentioned a compromised DevOps laptop, but no investigator has connected the two.