For about 11 hours on 29 October, Cursor’s extension marketplace served tampered versions of Anthropic’s Claude Code extension to Windows and Mac users. Cursor says versions 2.1.312 and 2.1.313 “were not developed by Anthropic”. The malicious code gathered details about the computer and its user, tried to add an attacker-controlled SSH key, tried to open remote access and set itself up to keep retrying. How the attackers got in has not been disclosed.
Cursor says it has removed the versions, rebuilt its marketplace and rotated its own keys. It says remote login probably failed on most machines because enabling SSH needs admin rights, but still advises a full clean-up. The Hacker News reports that Cursor put the number of affected users at no more than 5,000. Anthropic has published a clean version, 2.1.314.
What to do: if you use Claude Code inside Cursor and it updated on 29 October, follow Cursor’s security notice to check for an SSH key labelled “svc-telemetry”. If it is there, isolate the machine, run Cursor’s clean-up script or rebuild it, and rotate passwords, tokens and sessions from a trusted device. Uninstalling the extension alone may not be enough.
Why it matters: AI coding agents often run with wide access to code and credentials, which makes the channels that deliver them a target.