TL;DR
What happened with the fake Claude Code extension in Cursor?
For about 11 hours on Thursday, a fake Claude Code add-on in Cursor's store reached up to 5,000 users and planted a hidden login key on their computers. That key can stay on your computer even after you remove the add-on. If you use Cursor, update to version 2.1.314 and run Cursor's check today.
What happened to the Claude Code extension in Cursor?
On Thursday, October 29, 2026, from about 5:27am to 4:35pm ET, a tampered copy of Anthropic's Claude Code extension was available in the extension marketplace inside Cursor, a popular AI code editor. An extension is an add-on you install to give the editor extra features. The bad copies were versions 2.1.312 and 2.1.313, for Mac and Windows.
Cursor's security notice says the malicious versions "were not developed by Anthropic." In a post on X, Cursor said at most 5,000 users were affected and asked everyone to update to version 2.1.314. That 5,000 is a ceiling, not a confirmed count of infected machines.
Cursor pulled the bad versions, shut the whole marketplace down as a precaution, rotated its own keys and brought it back online. It also worked with the hosting company to take the attacker's server offline.
What did the malicious extension do?
Microsoft's security team took the code apart on Friday. When the extension loaded, it tried to:
- Add a hidden login key. It wrote an SSH key labeled
svc-telemetryto your computer. SSH is a way to log in to a computer remotely, and the key works like a spare password for whoever holds the matching half. - Open a reverse tunnel. It tried to connect out to the attacker's server so the attacker could reach back in, retrying about every 60 seconds.
- Restart itself. It set up a LaunchAgent on Mac or a scheduled task on Windows, both of which run programs automatically at startup, with names made to look like system tools.
- Report back. It collected your computer name, username, Git email, public IP address and the names of settings that look like passwords or API keys. Microsoft says it sent the names, not the secret values.
The extension kept working normally the whole time, so nothing looked wrong.
Could the attacker get into your computer?
On most machines, probably not through the tunnel. Cursor says turning on the SSH service needs administrator rights, which the extension didn't have on most Mac and Windows computers, and bugs in the code made that step fail. The attacker's server is also offline now.
The key, the startup scripts and the data report could still land, though. Microsoft says the loader "may still write keys and persistence artifacts even when tunnel access fails," and Cursor says uninstalling the extension may not be enough. Both companies say to clean up anyway.
How did a fake version get into the marketplace?
The accounts don't match yet. Ars Technica, citing security researchers, reports the bad version went out through Anthropic's official publisher account. Cursor and Microsoft say Anthropic did not develop it, and Microsoft says Anthropic confirmed its systems were not compromised. Microsoft also says the copies on the official Visual Studio Marketplace and on npm, a site developers download code packages from, were not affected.
The jargon, in one line each
| Term | What it means |
|---|---|
| Extension | An add-on that gives a code editor extra features |
| Marketplace | The in-app store where you find and install extensions |
| SSH key | A digital key that lets someone log in to a computer remotely |
| Reverse tunnel | A connection your computer opens outward so someone can reach back in |
| Rotate credentials | Replace your passwords, tokens and API keys with new ones |
X reactions
Cursor and Microsoft both posted updates on Friday (excerpts of longer posts).
Our take
Cursor moved fast and published clear cleanup steps, and that deserves credit. Still, a famous name on an extension listing told users nothing about whether the code inside was safe, and that should worry anyone who installs AI add-ons with one click.
Lots of beginners and solo builders now build apps in Cursor without ever opening a terminal. If that's you, take ten minutes today to run the check, because the leftover key won't announce itself. Going forward, slow down on brand-new versions and install add-ons only from listings you can trace back to the publisher.
— Artificially Nerdy
What to do today
- Check your Claude Code version in Cursor. Update to 2.1.314 if it shows 2.1.312 or 2.1.313.
- Run Cursor's one-line check from its security notice. It looks for the
svc-telemetrykey and tells you if your machine is affected. - Key found? Run Cursor's cleanup script for Mac or Windows, since removing the extension alone leaves the startup scripts behind.
- Change your passwords and API keys from a different, clean device if your machine was affected. Start with anything saved on that computer.
- Teams using Cursor: Microsoft points to Cursor's security settings for limiting extensions to approved publishers and adding a waiting period before new versions install.
- Not using Cursor? Nothing to do. Microsoft says the official VS Code Marketplace and npm copies were clean.
FAQ
I installed Claude Code on Friday. Am I affected?
Cursor's notice covers installs or updates between 2:27am and 1:35pm PT (5:27am to 4:35pm ET) on Thursday, October 29. Running the check still takes seconds, so do it anyway.
Does this affect Linux?
Cursor lists the bad versions for Mac and Windows. Microsoft's analysis describes Linux behavior in the code too, so Linux users should run the same key check.
Were my passwords stolen?
Microsoft says the extension sent the names of password-like settings, not their values. Cursor adds that this doesn't rule out later access through the backdoor, which is why it says to change credentials on affected machines.
Is Claude Code itself unsafe now?
No. Cursor says it has no evidence that other versions or the official distribution were affected, and 2.1.314 is the version it asks everyone to use.
Sources
- Cursor: Security notice for Anthropic.claude-code 2.1.312 and 2.1.313 — exposure window, what the code does, admin-rights limit, check and cleanup scripts.
- Microsoft Security blog: Inside a malicious Claude Code-branded extension — technical analysis, names-not-values detail, Anthropic's statement, hardening advice.
- Ars Technica: Anthropic VS Code extension on Cursor backdoored for nearly 12 hours — researchers' account of the publisher account.
- The Verge: Cursor says around 5,000 people may have installed a malicious Claude Code extension — user count.
- Cursor on X — October 30, 2026, 3:46am ET; 5,000 ceiling and 2.1.314.
- Microsoft Threat Intelligence on X — October 30, 2026, 9:10pm ET.
