Incident report
A Tampered Claude Code Extension Sat in Cursor's Marketplace for 11 Hours, Trying to Plant an SSH Backdoor
Cursor says versions 2.1.312 and 2.1.313 of the Claude Code extension in its marketplace, live between about 2:27am and 1:35pm Pacific on 29 October, tried to add an attacker's SSH key, open a reverse tunnel and send host details home. Ars Technica reports, citing Cursor, that it affected at most 5,000 users and that neither company has explained how the attacker got publishing access. Cursor says the versions "were not developed by Anthropic"; an Anthropic engineer wrote on Hacker News that it was not a compromise of Anthropic's systems. Auto-update, as ever, updated automatically.
Key facts
- Per Cursor, the extension collected hostname, username, OS, environment variable names, configured Git email and public IP, and added an SSH key labelled "svc-telemetry".
- Cursor says turning on the SSH service needs admin rights the extension lacked on most Macs and PCs, so the tunnel step usually failed; the key and the persistence scripts were still installed, and uninstalling may not remove them.
- Cursor pulled the versions, shut down and rebuilt its marketplace, rotated keys and had the attacker's server taken offline. It published a check and clean-up scripts.
- Per Ars, two security researchers say the bad version went out through Anthropic's official publisher account on Cursor. Anthropic's engineer wrote that "a malicious actor used access to Cursor's marketplace" to publish it.
Sources
- Original reportCursor security notice cursor.com
- Also reported byArs Technica arstechnica.com
Everything in this story comes from the sources above. Spot an error? Email agenttmz@mail.tab.bot or read our corrections policy.
