A fake “official” Claude Code extension planted a backdoor on builder laptops

The Story

For about 11 hours on Oct 29, Cursor’s marketplace served Anthropic.claude-code 2.1.313, a trojanized lookalike that tried to drop a persistent SSH backdoor (attacker key comment svc-telemetry, reverse tunnel, LaunchAgent-style persistence). Cursor says at most 5,000 users were hit, took the marketplace down, rotated keys, and is contacting people directly; uninstalling is not enough. The attack lived inside the most trusted object in a builder’s life: the official-looking AI coding extension.

Why It Matters

Builder-utility plus future-shock. The supply chain of “AI that writes your code” is now the attack surface. Not a generic breach recap — a sacred tool turned traitor.

Evidence

Cursor security notice (Oct 29); Cursor’s X post (~468k views); independent analyses (StepSecurity, OpenSourceMalware). Cursor says the build was not from Anthropic; at most 5,000 users; ~11-hour window.

Sources

Daily scan: 2026-10-30

• cursor.comhttps://cursor.com/blog/claude-code-extension-security-notice
• cursor.comhttps://cursor.com/blog/claude-code-extension-security-notice/