On October 29, Cursor identified and removed modified versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for macOS and Windows. They were available from 2:27 a.m. to 1:35 p.m. Pacific time. Anthropic did not develop the malicious builds; its official distribution channels were not affected.
What the modified extension attempted
According to Cursor, the payload attempted to establish a persistent SSH backdoor: collect host information, add an attacker-controlled public key to authorized_keys, and open a reverse tunnel. Cursor removed the builds, temporarily shut down its marketplace, audited other extensions and rotated its keys.
Why provenance matters
This was a tampered VS Code extension distributed through a specific marketplace, not a flaw in the model or an agent hook. The same extension ID and version can refer to different artifacts depending on where they were downloaded. Record the source and verify the artifact, not just its name.
Follow the official advisory and check the indicators before reinstalling.
Record the marketplace, version and artifact hash in your extension inventory.
If the payload ran, isolate the host, inspect SSH keys and rotate exposed credentials.
Update to a clean version through a verified channel; Cursor recommends 2.1.314.
An artifact’s origin is part of its identity. Its name and version do not tell the whole story.
Sources: Cursor security notice(Opens in a new tab) and Microsoft Security analysis(Opens in a new tab).