Backdoor in Cursor: How a fake Claude Code extension exposed up to 5,000 developers

On October 29, 2026, the software development ecosystem was the target of a surgical supply-chain attack. A tampered version of the official anthropic.claude-code extension was made available on the Cursor Extension Marketplace, a plugin store for the Cursor code editor. For an interval of approximately 11 hours, the malicious package operated silently, injecting a JavaScript loader programmed to establish a persistent Secure Shell (SSH) backdoor on victims' machines, in addition to collecting sensitive metadata from the development environment.

This incident highlights the growing vulnerability of AI-assisted tools and niche marketplaces, which have become primary targets for threat actors seeking corporate access. Anthropic, the creator of the Claude model, confirmed that its internal systems were not compromised and that the malicious extension was neither developed nor signed by them. The attack was strictly confined to the Cursor marketplace and did not affect packages distributed on the Microsoft Visual Studio Marketplace or the official @antropic-ai/claude-code package via npm.

Context and background of the intrusion

The adoption of AI-driven code editors like Cursor has grown exponentially in recent years. Developers use extensions to integrate AI assistants directly into their workflows, allowing for real-time code generation, refactoring, and analysis. The Claude Code extension is one of the most sought-after tools in this segment, making it an ideal target for code injection campaigns or typosquatting.

Historically, supply-chain attacks on extension marketplaces exploit the implicit trust users place in these platforms. Before this incident, developers installed and updated the Claude Code extension via the Cursor Marketplace without incident. However, quality control and automated verification policies in smaller or niche marketplaces are often less rigorous compared to established ecosystems, such as Microsoft's.

On October 29, 2026, at 02:27 AM (PDT), the scenario changed. The Cursor marketplace infrastructure began distributing compromised versions of the extension, allowing third-party code to be executed with the same user privileges on the operating system. The exposure window remained open until 13:35 PM (PDT), at which point the anomaly was detected, the extension was removed, and the platform was restarted.

The anatomy of the attack and concrete data

Technical analysis conducted by threat intelligence teams revealed the mechanics of the attack. The malicious versions distributed were specifically 2.1.312 and 2.1.313 of the anthropic.claude-code extension. During the period of activity, Cursor estimates that up to 5,000 users on Windows and macOS systems downloaded or automatically updated to the compromised versions.

The attack did not rely on external binaries; it used a 66-line JavaScript loader inserted into the package, executed immediately before the legitimate extension initialized. The infection flow occurred in five rigorous stages:

1. Reconnaissance: The loader collected fundamental host information, including machine name, username, operating system, architecture, working directory, home folder path, and the global email configured in Git. Most critically, it scanned environment variables for keys containing terms such as SECRET, TOKEN, PASS, AWS, or GCP, storing the names of up to 40 compatible variables.
2. SSH Access Preparation: The script checked the user's authorized_keys file. If it did not find the svc-telemetry identifier marker, it injected an Ed25519 public key embedded in the code. This authorized access for any individual in possession of the corresponding private key.
3. Reverse Tunnel Establishment: The code decoded a second private key, writing it to a hidden temporary file named .stk_ (followed by ten hexadecimal characters). Then, it used native system binaries (ssh or autossh on macOS/Linux, and a PowerShell loop on Windows) to initiate a reverse SSH tunnel. The executed command included the arguments -N -R *:0:localhost:22, requesting that the remote server (controlled by the attacker) redirect connections to port 22 (local SSH) of the victim's machine. The IP used by the attacker's infrastructure was identified as 134.209.82.225:8099.
4. Operating System Persistence: The loader wrote scripts and specific startup configurations for each platform, ensuring that the reverse tunnel and SSH access would survive machine reboots or the closing of the code editor.
5. Data Exfiltration: After the persistence and access setup attempts, a delayed callback went into action, transmitting the host metadata and the collected environment variable names to the remote server via simple HTTP traffic.

Impact on the sector, users, and the Latin American market

The impact of a backdoor attack in development environments is structural and systemic. For the tech sector, this event reinforces the "false security" of third-party extensions. Many security teams actively monitor the installation of executable software but neglect IDE plugins, which operate with broad permissions to read source code, access production environment variables, and modify system files.

For affected users, the consequences go far beyond simple malware. The reverse tunnel technique configured by the attacker allows for bypassing corporate firewalls and NAT (Network Address Translation) networks, granting direct remote shell access to the developer's computer. From there, an attacker can pivot to other machines on the corporate network, steal proprietary source code, or inject malicious code into company repositories.

In the Latin American market, which has consolidated itself as a hub for IT outsourcing and software development for North American and European corporations, this risk is amplified. Professionals and squads based in Brazil, Mexico, and Colombia frequently access critical client infrastructures abroad. The compromise of a single third-party developer's machine via a malicious extension can serve as the initial intrusion vector for a global corporation.

A critical point for Incident Response (IR) teams is post-infection cleanup. Removing the Cursor extension does not mitigate the threat. Since the loader inserted the svc-telemetry key directly at the OS level and configured persistence, the backdoor remains autonomously active. A detailed forensic audit is required to remove hidden artifacts and rotate all credentials potentially exposed on the affected machines.

What is still unknown

Despite the detailed analysis of the payload, there are critical gaps in the understanding of the event:

• Compromise Success Rate: It is unclear how many of the up to 5,000 exposed users had their machines effectively compromised. The successful execution of the reverse SSH tunnel depended, in most cases, on the local SSH service already being active and, often, on the editor running with administrator privileges (an uncommon but possible scenario).
• Data Exfiltration Scope: The investigation confirmed that the loader collected environment variable names (revealing which services and platforms the developer uses), but there is no conclusive evidence or definitive technical confirmation regarding whether the exact values of these variables (such as AWS keys or GCP tokens) were stolen or intercepted later through the established tunnel.
• Authorship and Motivation: The identity of the threat actor and their final objective remain hidden. The use of a specific IP address (134.209.82.225) was shut down in coordination with hosting providers, but the broader infrastructure and the attacking group's affiliation (whether profit-motivated cybercrime or state-sponsored espionage) have not yet been attributed.

What to expect next

In the coming months, the incident will force a shift in stance across the entire developer tools industry.

• Rigorous Audit of Smaller Marketplaces: Editors that maintain their own ecosystems, such as Cursor, will implement much stricter automated verification policies and static code analysis, aligning with the security standards of stores like Microsoft's or Apple's.
• Constant Remediation Actions: Organizations will conduct large-scale scans using Indicators of Compromise (IoCs), such as the svc-telemetry key, to ensure no machine on the network has a dormant backdoor.
• Credential Rotation: Companies will mandate the compulsory rotation of all API keys, cloud tokens, and passwords that resided in the development environments of machines affected between October 29 and subsequent dates, aiming to neutralize any potential lateral access. Cursor has already rotated its own cryptographic keys post-incident.

Frequently asked questions

1. Is my Claude Code extension in Microsoft's Visual Studio Code also infected? No. Microsoft and forensic analysis confirmed that the malicious extension was distributed exclusively through the Cursor Extension Marketplace. The Microsoft Visual Studio Marketplace ecosystem and the npm repository (@antropic-ai/claude-code) remained secure and were not affected by the incident.

2. Does simply uninstalling the Cursor extension resolve the security issue? No. The malicious script performed modifications at the operating system level. It altered the authorized_keys file by adding the svc-telemetry key, created hidden files (such as .stk_), and established persistence scripts to ensure the backdoor survived a reboot. Manual cleanup or reformatting the compromised environment is necessary.

3. Was Anthropic hacked in this incident? Anthropic confirmed that its internal systems were not breached, nor were the laptops of its employees. The tampered version (2.1.312 and 2.1.313) was not created by Anthropic; the attacker managed to introduce the malicious package directly into the third-party marketplace (Cursor) by faking the identity of the legitimate extension.