For about eleven hours on Thursday, 29 October 2026, the safest-looking thing in a developer’s editor was not safe. A tampered version of Anthropic’s Claude Code extension — a Cursor extension backdoor — was available in Cursor’s VS Code Extension Marketplace, distributed through Anthropic’s official Cursor account, and Cursor said it affected at most 5,000 users. It arrived through the verified account. How the account behind it slipped out of its owner’s control has not been explained, and whether the badge stayed displayed throughout the window is an inference from that distribution, not a documented display.
That gap, between the badge and the control behind it, is the story. The malware was serious. What makes this incident significant, on the documented record, is the channel it used: distribution through the official account, with automatic updates on by default.
The eleven-hour window
According to Cursor, as reported by Ars Technica, anyone who installed or updated Anthropic’s VS Code extension from Cursor between 5:27 a.m. and 4:35 p.m. Eastern Time on Thursday should consider themselves affected. In Pacific Time, Cursor put the window at about 2:27 a.m. to 1:35 p.m. The malicious version was 2.1.313, superseding 2.1.312, according to independent researcher Kevin Beaumont and Phorian chief technology officer Luke Roberts, as reported by Ars. Beaumont also reported that Anthropic pushed version 2.1.314 several hours after the malicious version became available on Cursor.
Cursor’s notice, as summarised by multiple outlets, names both versions 2.1.312 and 2.1.313 for Windows and macOS as malicious, and states they were not developed by Anthropic. Ars centres on 2.1.313. If you were in the window, check both numbers, not just the headline one.
The reach figure needs the same care. Cursor said at most 5,000 users were affected, via download or automatic fetch. Extensions auto-update in Cursor by default, Roberts told Ars, though users can change that. At most 5,000 is a ceiling for exposure, not a count of machines that ran the payload. The reporting does not settle how many actually installed or ran it.
What the payload tried to do
Cursor described a package that tried to do several things at once. It collected host and user details — hostname, username, operating system, architecture, home-directory path, environment-variable names, working directories, configured Git email, public IP — and attempted to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel. It tried to make that tunnel persistent, via a LaunchAgent on macOS and a scheduled task with a startup-script fallback on Windows, retrying roughly every 60 seconds, and it reported host details and backdoor status via HTTP POST to /beacon on port 8099.
There is a qualification, and it cuts both ways. Cursor and Phorian reported that the SSH-tunnel step would fail on most affected computers without administrator privileges. That is reassuring about remote login, not about the rest: the attacker’s key could still be added, persistence files installed, and reconnaissance data sent back. What an operator could do with collected environment-variable names is a further question: such names could, in principle, point to where credentials and tokens live, but the package does not establish that purpose, or that any prioritisation of machines followed. Names are not the credentials themselves, and the reporting does not claim credentials were taken in every case.
That last point is the one Cursor itself stressed: uninstalling the extension may not be sufficient, because the payload drops standalone persistence scripts that keep running. Cursor advised affected developers to check for the attacker key, labelled svc-telemetry, remove persistence mechanisms, and rotate credentials accessible from the machine using a clean device.
What did the badge actually promise?
Roberts described the incident to Ars as a supply-chain compromise in which the attacker gained access to the official distribution channel. That points at the mechanism that should worry developers most. This was not a lookalike package or an abandoned extension: it arrived through the official account, under a trusted name, in a professional developers’ marketplace, with the receiving default set to fetch it automatically.
What a verification badge continuously asserts is unresolved in the reporting: the package documents distribution through the verified account, not the verification process, any ongoing checks, or whether users received warnings while the tampered version was available. The question is therefore not whether verification is worth having — it plainly is — but what it should guarantee over time. If it only photographs who held an account once, the interval between losing control and anyone noticing is one in which trust does active harm.
There is a counterweight, and it deserves stating plainly. The failure described is loss of control of a publisher account, not proof that the verification check itself was forged. And Cursor’s response, once the version was detected, was the response you would want: remove it, block further distribution, shut the whole marketplace, rotate keys, audit access, confirm no other extensions were compromised, rebuild, and reopen, while working with the hosting provider so infected devices could no longer reach the attacker’s server. Containment worked. Detection, and the account security that should have prevented the need for containment, are the parts still unexplained.
What is still unexplained about the Cursor extension backdoor
As of Ars Technica’s report on 30 October, it was still unknown how attackers got access to Anthropic’s verified Cursor account, and neither company had explained it. Ars also reported that Anthropic had yet to issue public notice to customers as of publication. Separately, The Register reported a post by Anthropic staff member Felix Rieseberg saying the incident was not a compromise of Anthropic’s systems or employee laptops, and that a malicious actor used access to Cursor’s marketplace to publish a tampered copy Anthropic did not build or publish. Both can be true — a staff post denying a compromise of Anthropic’s own systems is not a customer notice, and it does not explain how the marketplace account was taken over — which is why developers should not fill the gap with a theory.
The Register also reported that neither company had, at that point, commented on how the package reached the marketplace. What Cursor has not said, in the reporting available, is what changed about publisher-account protection, or what would catch the next takeover sooner than eleven hours.
Auto-update deserves a fair hearing too. The same default that delivered the tampered version normally delivers security fixes quickly, and turning it off everywhere would leave developers running old, vulnerable extensions for longer. But a default that silently installs whatever the official account publishes is only as safe as the account itself — and this incident shows that account is a single point of failure with no tripwire for recipients documented in the reporting.
What to do, and what to watch
If you installed or updated the Claude Code extension from Cursor during the window, treat Cursor’s documented remediation steps as the starting point, not the update button: check for the svc-telemetry key, remove persistence mechanisms on your platform, and rotate credentials that were accessible from that machine, from a clean device. If you only updated after the window, to a clean version, the reporting does not say you are affected — but if there is any doubt about when you updated, the window, not the version you have now, is the test.
For everyone else, the questions to watch are concrete. How was the account taken over? What signal ended the window, and can it be made faster? How many machines still carry the key or a persistence script after updating? And what does Cursor now require, continuously rather than once, before a verified account may publish? Until those questions have answers, the honest summary is narrower than the headline and more unsettling than the malware alone: a backdoor reached developers through the marketplace’s most trusted door — the official account — while how that account was taken over remains unexplained.
