Anthropic: That Claude Code extension compromise… couldn't be us

Summary

An unknown actor distributed a tampered copy of the Claude Code extension through Cursor's marketplace. The Register reported up to 5,000 infected developers and identified the malicious release as version 2.1.313. According to Cursor's account quoted in the report, the package was downloadable for approximately 11 hours on October 29, 2026. The implant targeted Windows, macOS, and Linux, collected host and user information, installed persistence, and attempted to establish reverse SSH access.^[0]

The principal operational distinction is between failed remote access and an uncompromised endpoint. The tunnel-opening script reportedly required administrator rights on macOS and Windows, causing it to fail in the vast majority of cases. Nevertheless, the extension still forwarded collected information, placed the attacker's SSH key, and installed persistence. An extension update alone therefore did not complete remediation, and affected developers were directed to investigate their systems and use Cursor's incident-specific cleanup guidance.^[0]

Anthropic denied that its systems or employee laptops had been compromised. Technical staff member Felix Rieseberg said the tampered copy was neither built nor published by Anthropic, that official channels were unaffected, and that the incident affected Cursor users. Cursor reported removing the package, interrupting marketplace distribution, rotating its own keys, checking other extensions, and coordinating a block on the attacker's server. The report did not establish how the malicious package entered the marketplace.^[0]

Attack chain

1. Malicious extension distribution: An unknown party pushed a tampered update of the Claude Code extension to Cursor's marketplace. Version 2.1.313 was available during the reported approximately 11-hour window. Anthropic said the attacker used access to Cursor's marketplace, but the underlying access mechanism was not disclosed.^[0]
2. Endpoint implant activity and attempted remote access: The extension's implant collected host and user information, including usernames, configured Git email addresses, and public IP addresses, and forwarded that information to the attacker. It also placed an attacker SSH key, installed persistence, and attempted to open a reverse SSH tunnel. The report does not establish the internal ordering of those actions. On macOS and Windows, the tunnel-opening script required administrator rights that were reportedly absent in the vast majority of cases; the other implant effects remained despite tunnel failure.^[0]

Disclosure timeline

How it works

The documented compromise mechanism was distribution of a tampered extension through Cursor's marketplace, not exploitation of a specifically identified software vulnerability. Anthropic attributed publication to a malicious actor with marketplace access, while the report left the origin and nature of that access unresolved.^[0]

The payload combined information collection with an SSH-based backdoor. It gathered host and user details, forwarded those details to the attacker, placed an attacker SSH key, installed persistence, and attempted a reverse SSH tunnel. The report described implementations for Windows, macOS, and Linux but did not supply the persistence artifacts or commands.^[0]

A privilege dependency limited the remote-access component: the script responsible for opening the tunnel required administrator rights on macOS and Windows and usually lacked them. That limitation did not neutralize the implant's information forwarding, SSH-key placement, or persistence. The report therefore explicitly distinguished tunnel failure from successful cleanup.^[0]

Affected versions and patch status

Key takeaways

• A failed reverse SSH tunnel does not establish that an affected endpoint is clean: information forwarding, attacker-key placement, and persistence were reported to occur despite that failure.^[0]
• Keep the distribution-channel finding separate from upstream attribution. The report establishes a tampered package in Cursor's marketplace and records Anthropic's denial of an internal compromise; it does not establish how the attacker obtained marketplace access.^[0]
• The reported figure of up to 5,000 infected developers should not be interpreted as a count of successful remote-access sessions. The same report says the tunnel-opening component failed in the vast majority of cases.^[0]

Defensive actions

• Identify endpoints that installed Claude Code extension version 2.1.313 through Cursor during the reported October 29 distribution window.: The report identifies this version and marketplace as the malicious distribution scope. Include Windows, macOS, and Linux endpoints because the implant was written for all three platforms.^[0]
• Use Cursor's incident-specific remediation instructions and cleanup scripts; do not treat installation of a newer extension as sufficient remediation.: The malicious extension installed persistence that survives an extension update. The report explicitly points affected users to Cursor's cleanup material rather than update-only recovery.^[0]
• Investigate affected endpoints for the implanted SSH key, persistence, information forwarding, and evidence of reverse SSH activity, including whether local privileges permitted the tunnel to open.: The report calls for threat hunting because some instances may have allowed the tunnel to succeed. On macOS and Windows, absent administrator rights reportedly prevented most tunnel attempts, but did not prevent the other compromise effects.^[0]