# Backdoored Claude Code extension 2.1.312 and 2.1.313 hit Cursor's extension marketplace

Canonical: https://theagenticweekly.com/news/cursor-marketplace-claude-code-extension-backdoor · Evidence: Reported · First seen: 2026-10-30 13:15 UTC · Source published: not stated by the source · Brief published: 2026-11-01 00:01 UTC · Updated: 2026-11-01 00:01 UTC · Author: Agentic Weekly

> Cursor's security notice says tampered Anthropic.claude-code versions 2.1.312 and 2.1.313 were in its VS Code Extension Marketplace from about 2:27am to 1:35pm PT on October 29, 2026, and that the extension "attempts to install a persistent SSH backdoor". Cursor says the versions were not developed by Anthropic.

## What changed

- Cursor says a maliciously modified Anthropic.claude-code extension, versions 2.1.312 and 2.1.313 for Windows and macOS, was available in the Cursor VS Code Extension Marketplace between about 2:27am and 1:35pm PT on October 29, 2026.
- Per Cursor, the payload reports host and user details (hostname, username, OS, home directory, environment variable names, Git email, public IP), adds an attacker SSH key labelled svc-telemetry and tries to open a persistent reverse SSH tunnel.
- Cursor says turning on the local SSH service needs admin rights the extension lacks on most macOS and Windows hosts, so that step fails there, but the key, persistence and host report still land. It says the attacker server is now offline.
- Cursor removed the versions, shut down and rebuilt the marketplace and rotated its keys. It says it audited access, found no other tampered extensions and has no evidence that other versions or the official distribution are affected.
- If you installed or updated to 2.1.312 or 2.1.313 from Cursor's marketplace in that window, Cursor says to check for the svc-telemetry key, isolate affected hosts, remove the key, persistence and tunnel processes, and rotate credentials from a trusted system.
- Phorion, which found the extension, says its macOS setup check is buggy and skips enabling SSH for a standard user, but still calls the malware a significant threat because it installs persistence and reports host details.

## In the source's words

> "These malicious versions of the extension were not developed by Anthropic."
> (Cursor security notice, https://cursor.com/blog/claude-code-extension-security-notice)

> "Uninstalling the extension may not be sufficient"
> (Cursor security notice, https://cursor.com/blog/claude-code-extension-security-notice)

> "installs persistence and beacons host reconnaissance back to the operator"
> (Phorion security advisory, https://phorion.io/blog/offical-claude-code-vsx-compromise/)

## Early verdict

If you use Claude Code inside Cursor, check the installed extension version and run Cursor's svc-telemetry check now; uninstalling alone may not remove the persistence. (Basis: Based only on Cursor's security notice (updated Oct 30, 2026) and Phorion's advisory; we have not run the scripts.)

## What we have not verified

- We did not run Cursor's check or remediation scripts, or analyse the malicious extension ourselves.
- Cursor's notice does not say how the tampered build reached its marketplace.
- Press reports give a download count; Cursor's notice page does not, so we leave it out.
- Anthropic staff said on social media and Hacker News that Anthropic's systems were not compromised; we did not find an official Anthropic page on the incident.

## Timeline

- Source published: not stated by the source
- First seen by our watcher: 2026-10-30 13:15 UTC (via Hacker News front page (AI posts))
- Brief published: 2026-11-01 00:01 UTC

## Sources

- [Cursor: security notice on Anthropic.claude-code 2.1.312 and 2.1.313](https://cursor.com/blog/claude-code-extension-security-notice) (primary source) (fetched 2026-10-31)
- [Phorion: Claude Code extension compromise advisory](https://phorion.io/blog/offical-claude-code-vsx-compromise/) (fetched 2026-10-31)

## Related

- [Claude Code: verdict and setup guide](https://theagenticweekly.com/tools/claude-code)
- [Cursor: verdict and setup guide](https://theagenticweekly.com/tools/cursor)
- [Claude Code vs Codex CLI](https://theagenticweekly.com/compare/claude-code-vs-codex-cli)
- [Claude Code vs Cursor](https://theagenticweekly.com/compare/claude-code-vs-cursor)
- [Claude Code vs Gemini CLI](https://theagenticweekly.com/compare/claude-code-vs-gemini-cli)
- [Alternatives to Claude Code](https://theagenticweekly.com/alternatives/claude-code)
- [All news briefs](https://theagenticweekly.com/news)
- [This week's releases](https://theagenticweekly.com/this-week)
- [New AI models this week](https://theagenticweekly.com/models/this-week)

## How to cite

Agentic Weekly, "Backdoored Claude Code extension 2.1.312 and 2.1.313 hit Cursor's extension marketplace", published 2026-11-01 00:01 UTC, https://theagenticweekly.com/news/cursor-marketplace-claude-code-extension-backdoor