Fake Claude Code extension in Cursor tried to open a backdoor to users' computers

The coding tool Cursor has warned about a malicious extension that posed as Claude Code. The extension was listed in Cursor's extension marketplace and tried to give attackers remote access to users' computers. Cursor says Anthropic did not develop the malicious extension.

What happened?

According to Cursor's own security notice, the extension was available in the marketplace on October 29, 2026, from about 2:27 a.m. to 1:35 p.m. Pacific Time. That is roughly 11 hours. Cursor updated the notice on October 30 and now lists two affected versions, 2.1.312 and 2.1.313, for Windows and macOS. BleepingComputer and Techzine mention only version 2.1.313, which reflects an earlier tally.

Up to 5,000 users may have been affected, according to BleepingComputer and Techzine. Cursor's notice does not say how many people downloaded the versions.

What did the malware try to do?

The malware collected information about the computer, including hostname, username, operating system, Git email, public IP address and the names of environment variables.

It then tried to add a key for the attacker, labeled svc-telemetry, to the authorized_keys file, turn on SSH and set up a reverse tunnel to a specific IP address. SSH is a way to control a computer remotely, and the key would let the attacker log in without a password. To survive a restart, the malware tried to install itself as a persistent task on both macOS and Windows and attempted to connect about every 60 seconds.

According to BleepingComputer, the attackers lacked administrator privileges on most systems, and coding errors likely prevented remote access on many Windows and macOS computers.

Cursor's response and advice

Cursor removed the extension, temporarily took the entire marketplace offline and rotated keys. Together with the hosting provider, Cursor also had the attacker's server taken down. Cursor says the server is no longer operational. According to BleepingComputer, there are no signs that other extension versions or Anthropic's official distribution were affected.

Cursor recommends that users run validation scripts to look for the svc-telemetry key, isolate affected machines, run cleanup scripts for their platform and change all passwords and keys the machines had access to.

How the attackers managed to get the extension published under Anthropic's name has not been explained.