What Was Distributed, and for How Long
On 29 October 2026, version 2.1.313 of the Claude Code VS Code extension, published as anthropic.claude-code on Cursor's extension marketplace, shipped with a malicious loader embedded in its extension.js bundle. It arrived under the extension's legitimate publisher identity, so it presented as a routine update. Cursor reports at most 5,000 of its users received the trojanized build during an 11-hour window, whether by manual download or automatic fetch and install.
The two measurements of exposure differ by an hour at most. stepsecurity.io, which published analysis on 30 October, measured an 11-hour window; arstechnica.com described the compromise as lasting nearly 12 hours. Anthropic pushed version 2.1.314 several hours after 2.1.313 had become available on Cursor. Cursor, in a statement reported by thehackernews.com, said the malicious version was not developed by Anthropic and did not impact other extensions downloaded from the marketplace, and shut its marketplace down temporarily to remove the compromised package.
Five thousand is a distribution ceiling, not a compromise count. Cursor counted users who received the build; whether every recipient executed the loader, and on which operating systems, the published record does not state. The behaviors came to light through stepsecurity.io's sandbox and registry analysis, published the day after the build appeared. That one-day gap between distribution and public detection is the operating margin of this attack class: automatic updates install code before any human reviews it.
Inside the Payload: SSH Key, Persistence, Tunnel
stepsecurity.io's analysis of the loader identified four behaviors on execution. The extension planted an attacker-controlled SSH key on the host. It configured persistence on each operating system it could run on. It opened a reverse SSH tunnel to attacker infrastructure. And it transmitted host reconnaissance data over plain HTTP, meaning whatever machine inventory it sent left the host unencrypted and readable by anyone positioned on the network path between the machine and the collector.
The reverse tunnel is the component that matters most for exposure assessment. Outbound SSH from a developer workstation is routine and rarely filtered, which suggests the channel would survive ordinary egress policies. A tunnel lets the key holder reach the machine from outside, treating a workstation behind corporate NAT as an addressable host. The planted key and the persistence mechanism are independent of the extension itself: replacing version 2.1.313 with 2.1.314 removes the code, and leaves whatever the code installed on the disk.
The persistence layer was written against each operating system, which suggests the loader was built to run wherever the extension runs. stepsecurity.io's report did not enumerate what the reconnaissance data contained, only that it moved over plain HTTP. The sequence — key, persistence, tunnel, then inventory — reads as access establishment followed by assessment of what was accessed. The analysis confirmed the behaviors in sandbox and registry observation; attribution of the payload to a named actor appears nowhere in the published record.
Open Questions: Account Control, Disclosure, Remediation
How the build reached the marketplace under Anthropic's identity is unresolved. A report aggregated by hyper.ai states the incident involved unauthorized access to Anthropic's verified Cursor account, with the method of gaining that control unknown. Cursor's published statement says the exact method attackers used to introduce the unauthorized update remains unclear. Cursor stated the malicious version was not developed by Anthropic. Neither source explains how a verified publisher account distributed code its owner did not author.
Disclosure is asymmetric. Cursor published an incident statement and removed the package; Anthropic, as arstechnica.com reported on Friday, had so far not warned customers of the incident. The replacement 2.1.314 shipped within hours. The open question is whether Anthropic will issue guidance addressed to the artifact rather than the code, since an SSH key written to disk during the 11-hour window is not removed by updating an extension. Users who installed 2.1.313 need that instruction; no published guidance contains it.
Remediation beyond the update is undefined in the record. The attacker's identity, the destination of the tunnel, and the volume of reconnaissance collected are unstated; on each point the record is silent. Structurally, this incident shows where marketplace trust now fails: verification binds a publisher identity to an account, and a trojanized build published through that identity carries the full weight of the verification. The open question for Cursor and every marketplace operator is what check catches a malicious build when the check is who published it.
Sources
- arstechnica.com — Anthropic's Cursor Extension Was Backdoored for Nearly 12 Hours
- stepsecurity.io — Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines (2026-10-30)
- thehackernews.com — Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor (2026-10-30)
- hyper.ai — Anthropic VS Code Extension Backdoored on Cursor for Nearly 12 Hours | Trending Stories
- New Horizon daily digest, 2026-10-31 (topic provenance)