Reported News
Backdoored Claude Code extension 2.1.312 and 2.1.313 hit Cursor's extension marketplace
Cursor's security notice says tampered Anthropic.claude-code versions 2.1.312 and 2.1.313 were in its VS Code Extension Marketplace from about 2:27am to 1:35pm PT on October 29, 2026, and that the extension "attempts to install a persistent SSH backdoor". Cursor says the versions were not developed by Anthropic.
- Changes reported
- 6
- listed below, each from a source we read
- We tested
- 0
- we did not run it ourselves
- Gaps we flag
- 4
- things we could not verify
- Sources
- 2
- 1 primary, linked below
What changed
| # | What the source says | Status |
|---|---|---|
| 01 | Cursor says a maliciously modified Anthropic.claude-code extension, versions 2.1.312 and 2.1.313 for Windows and macOS, was available in the Cursor VS Code Extension Marketplace between about 2:27am and 1:35pm PT on October 29, 2026. | Reported |
| 02 | Per Cursor, the payload reports host and user details (hostname, username, OS, home directory, environment variable names, Git email, public IP), adds an attacker SSH key labelled svc-telemetry and tries to open a persistent reverse SSH tunnel. | Reported |
| 03 | Cursor says turning on the local SSH service needs admin rights the extension lacks on most macOS and Windows hosts, so that step fails there, but the key, persistence and host report still land. It says the attacker server is now offline. | Reported |
| 04 | Cursor removed the versions, shut down and rebuilt the marketplace and rotated its keys. It says it audited access, found no other tampered extensions and has no evidence that other versions or the official distribution are affected. | Reported |
| 05 | If you installed or updated to 2.1.312 or 2.1.313 from Cursor's marketplace in that window, Cursor says to check for the svc-telemetry key, isolate affected hosts, remove the key, persistence and tunnel processes, and rotate credentials from a trusted system. | Reported |
| 06 | Phorion, which found the extension, says its macOS setup check is buggy and skips enabling SSH for a standard user, but still calls the malware a significant threat because it installs persistence and reports host details. | Reported |
reported by the sourcemeasured or run by usnot verified
Primary source: Cursor: security notice on Anthropic.claude-code 2.1.312 and 2.1.313. We are the fast, independent index; the vendor’s own page is the source of record for this release.
In the source’s words
“These malicious versions of the extension were not developed by Anthropic.”
“Uninstalling the extension may not be sufficient”
“installs persistence and beacons host reconnaissance back to the operator”
Early verdict
If you use Claude Code inside Cursor, check the installed extension version and run Cursor's svc-telemetry check now; uninstalling alone may not remove the persistence.
Basis: Based only on Cursor's security notice (updated Oct 30, 2026) and Phorion's advisory; we have not run the scripts.
What we have not verified
- We did not run Cursor's check or remediation scripts, or analyse the malicious extension ourselves.
- Cursor's notice does not say how the tampered build reached its marketplace.
- Press reports give a download count; Cursor's notice page does not, so we leave it out.
- Anthropic staff said on social media and Hacker News that Anthropic's systems were not compromised; we did not find an official Anthropic page on the incident.
This brief is Reported: written from the sources below, not from running the release ourselves.
Sources
- Cursor: security notice on Anthropic.claude-code 2.1.312 and 2.1.313primary source · fetched 2026-10-31
- Phorion: Claude Code extension compromise advisorysource · fetched 2026-10-31
Related
Spotted an error? See our corrections policy or email the address on the contact page. Markdown version for agents: /news/cursor-marketplace-claude-code-extension-backdoor.md
Want these briefs in your Google Top Stories? Add Agentic Weekly as a preferred source on Google.
The Weekly Verdict · free
5 new-model use cases. Every Monday.
A free email every Monday: the week's few big AI releases, then 5 short use cases for the new models, each with a prompt you can paste.
Free. Double opt-in. One click to unsubscribe.