Tampered Claude Code extension affects up to 5,000 Cursor users

The marketplace breach

Cursor recently notified customers that a tampered version of the Claude Code extension reached its internal marketplace. The malicious build was identified as version 2.1.313 and used the official identifier Anthropic.claude-code. Because it shared the name of a trusted AI lab, it was designed to appear legitimate to developers searching for the tool.

The company confirmed that Anthropic did not develop this specific version. Instead, a modified build was injected into the Cursor IDE extension marketplace. This type of incident is particularly dangerous because it exploits the trust relationship between a developer and their primary coding environment.

As reported by shattered.io, the exposure lasted for just over 11 hours on October 29, 2026. During this window, users who pulled updates could have unknowingly installed a version of the tool that contained malicious code. Cursor has since removed the bad build and reinstated the marketplace after confirming the risk was neutralized.

How the backdoor works

The tampered extension was designed with a three-part goal to compromise user machines. First, it attempted to perform reconnaissance by collecting basic system information, including IP addresses, usernames, and operating system details. This allows an attacker to identify high-value targets, such as corporate laptops versus private virtual machines.

The most severe part of the payload was the attempt to install a persistent SSH backdoor. By adding an attacker-controlled public key to a user's authorized keys file, the attacker could potentially log into the machine remotely. This method is particularly stealthy because it allows access without the extension even needing to be running.

Because coding extensions run with the same permissions as the user, they can naturally read files in open workspaces and spawn processes. The attacker did not need to find a complex software vulnerability; they simply waited for the user to click the install button. This turns a productivity tool into a direct pathway for unauthorized system access.

Who is at risk

Cursor has capped the impact of this incident at 5,000 users. While this is a relatively small number for a global platform, it represents a significant number of individual developer environments. The risk is highest for those who use automated update settings, which may have pulled the malicious build in the background during the 11-hour window.

Developers working in cloud environments or on machines with exposed SSH ports are at higher risk. If an attacker successfully planted a key, they could maintain access even after the user uninstalls the extension. This makes the incident a persistent threat rather than a one-time execution of a script.

The company is advising users to move to version 2.1.314 immediately. They have also provided a remediation script to help clean up potential traces. However, security experts suggest that simply running a script may not be enough if the machine has already been used to access sensitive cloud tokens or private Git credentials.

The shift in AI security

This incident follows a pattern of software supply chain attacks where attackers target trusted update channels. Unlike older attacks that targeted general software, this one targets AI agents that have high levels of autonomy. Because these tools are designed to edit files and run tests, a poisoned version can do much more damage than a standard malicious app.

The fact that the extension used a trusted name highlights a growing problem in the AI ecosystem. Users are less likely to audit a tool that bears the name of a major AI lab. This creates a situation where the marketplace becomes a high-value target for actors looking to gain a 'seat at the desk' of thousands of developers simultaneously.

Moving forward, this may lead to stricter requirements for extension signing and verification. Developers may need to adopt more rigorous 'zero trust' practices, such as pinning specific versions of tools or limiting the directories an AI agent can access. For now, the focus remains on rotating credentials and auditing SSH configurations for any unrecognized keys.