A trojanized copy of Anthropic's official Claude Code extension was distributed through Cursor's extension marketplace on October 29, under Anthropic's own publisher identity, according to Cursor and security researchers at OpenSourceMalware. Versions 2.1.312 and 2.1.313 carried a malicious loader inserted ahead of the legitimate extension code. Cursor says at most 5,000 users installed the bad update between about 2:27 a.m. and 1:35 p.m. Pacific time, and it temporarily shut its marketplace down to remove the package.

The loader added an attacker-controlled SSH key labelled "svc-telemetry" to the user's authorized_keys file, tried to enable the local SSH service, opened a reverse tunnel to an attacker server, installed persistence (a LaunchAgent on macOS, a cron entry on Linux, a scheduled task on Windows) and sent host details — hostname, username, operating system, public IP and the names of credential-related environment variables — to that server. Cursor says errors in the code meant the SSH step failed on most macOS and Windows machines unless Cursor had been started with administrator rights, and the attacker server has since been taken offline. Uninstalling the extension does not remove the key or the persistence.

Anthropic says its own systems were not compromised and that the versions on its official channels, including the VS Code and Open VSX marketplaces, are unaffected; the current clean release is 2.1.314. Microsoft confirmed the malicious version never appeared on its Visual Studio Marketplace or in the npm package. How the attacker was able to publish under Anthropic's name on Cursor's marketplace is still not explained.