Tampered Claude Code extension in Cursor's marketplace planted an SSH key

What happened#

On Oct 29, a tampered copy of the Claude Code extension sat in Cursor's VS Code extension marketplace for about 11 hours. Cursor's security notice puts the window at about 2:27am to 1:35pm PT and names versions 2.1.312 and 2.1.313 as malicious. Cursor says that code was "not developed by Anthropic."

Per Help Net Security, the injected code runs as soon as Node loads the extension file. It adds the attacker's SSH key to the authorized keys file and opens an outbound SSH connection, retrying about every 60 seconds.

Cursor says the planted key carries the comment svc-telemetry. Help Net reports the payload also sends the names (not the values) of up to 40 environment variables that look like keys or tokens.

It leaves persistence behind, too. The Register reports that installing the latest version doesn't remove it.

The Register quotes Anthropic's Felix Rieseberg saying a malicious actor "used access to Cursor's marketplace to publish a tampered copy," one Anthropic didn't build or publish. Anthropic says its official channels are unaffected. As of Oct 30, neither company had explained how the package reached the official marketplace.

Who is affected#

Cursor users on Windows or macOS who installed or auto-updated to 2.1.312 or 2.1.313 during that window. Cursor says at most 5,000 users were affected. FourWeekMBA notes that's an upper bound, not a count of compromised machines.

Exposed doesn't mean compromised. Cursor says enabling SSH likely fails without admin rights. Phorion's Calum Hall warned against leaning on that: if Remote Login was already on, the backdoor works.

So start with the machines that had a bad version and already had SSH turned on.

What to check this week#

• Search ~/.ssh/authorized_keys on every developer endpoint for a key with the comment svc-telemetry.
• Query extension inventory or endpoint telemetry for Anthropic.claude-code 2.1.312 and 2.1.313 in Cursor.
• List which of those machines have SSH or Remote Login on. That's where the planted key works.
• Isolate any host with the key. Remove it, hunt for the persistence entry, and decide whether to rebuild.
• Rotate credentials and sessions reachable from those hosts, from a trusted system. Start with whatever sits behind environment variables named like cloud keys or tokens.
• Don't count uninstalling or updating as cleanup. Cursor says uninstalling alone may not be enough, and The Register reports updating doesn't remove the persistence.
• Move developers to 2.1.314 and find out which editors auto-update extensions on their laptops.
• Decide who approves editor extensions on developer endpoints, and from which marketplaces.

Where Harden helps, and where it doesn't#

Harden Agentic Integrity Foundation (AIF) runs on the developer laptop, outside the agent, at the agent's pre-execution hook. It checks every command, file edit and push against the session's intent before it runs. Decisions happen locally, in milliseconds, under one policy across every agent.

Here's the limit. This payload ran as extension code when the editor loaded it. No agent issued it as a command. Harden wouldn't have stopped it from loading, writing the key or opening the connection. It doesn't contain a process that's already malicious, and it can't take back a credential that's already been exposed.

Where it does help: the same laptops run agents. If an agent session tries to edit authorized_keys, pipe curl to a shell or send a secret to a network call, Harden checks it before it executes. It starts watch-only, so you see what agents on those machines actually do before you enforce anything.

For this incident, the controls that matter most are endpoint telemetry, SSH hardening, extension approval and credential scoping. Harden is a layer on top of them.

Read more#

Start with how to secure coding agents on developer laptops.

• Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) in the Cursor VS Code Extension Marketplace
• Claude Code extension poisoned with persistent SSH backdoor
• Anthropic: That Claude Code extension compromise… couldn't be us
• Cursor Discloses Tampered Claude Code Add-On Hit Up to 5,000