Devs Hit by Trojanized Claude Code Extension for Cursor

Summary

An unnamed attacker replaced the Claude Code extension distributed through Cursor's marketplace with a malicious version, 2.1.313. According to Cursor's disclosure as reported by Dark Reading, developers who downloaded or updated the extension between 09:27 and 20:35 GMT on October 29, 2026, received the trojanized build. Cursor placed the affected population at no more than 5,000 users and said it would contact them directly. Cursor also stated that Anthropic did not develop the malicious version.^[0]

The modification reportedly consisted of a 66-line loader added to extension.js while the legitimate extension otherwise remained unchanged. Loading the extension activated the malicious code without requiring a Claude conversation. Its behavior combined host-metadata exfiltration with attempts to install an attacker-controlled SSH key, establish reverse tunnels, and persist through operating-system-specific background mechanisms. These were attempted remote-access capabilities, not evidence that every affected endpoint acquired a working backdoor: Cursor said enabling local SSH required administrative privileges that the extension rarely possessed.^[0]

Cursor reported key rotation, checks for tampering in other extensions, a temporary marketplace shutdown and rebuild, and coordination with a cloud hosting provider to take down attacker infrastructure. The initial intrusion mechanism remained unspecified. The article also covered separate embedded-browser exploitation research; that research should not be treated as the entry point or a later stage of this extension compromise.^[0]

Attack chain

1. 1. Distribution through a trusted extension channel: The attacker substituted malicious Claude Code version 2.1.313 in Cursor's marketplace. Developers downloading or updating the extension during the October 29 distribution window received the altered package. The report does not explain how the attacker obtained the ability to replace it.^[0]
2. 2. Execution on extension load: A 66-line loader added to extension.js executed when the extension loaded. No Claude conversation or additional interaction with the assistant was required. The legitimate extension code otherwise reportedly remained intact.^[0]
3. 3. Metadata theft and attempted persistent remote access: After activation, the malicious code sent system and user metadata through separate Web requests. It also attempted to add an attacker-controlled SSH key, establish reverse tunnels, and maintain access through a macOS LaunchAgent or Windows scheduled tasks and a fallback Startup script. The report does not establish the relative execution order of these payload behaviors or demonstrate successful persistent access across the affected population.^[0]

Disclosure timeline

How it works

The incident exploited the extension distribution and execution model rather than a disclosed software flaw. A small loader was inserted into extension.js while the rest of the legitimate extension reportedly stayed unchanged. Execution occurred at extension load, giving the malicious addition an execution trigger independent of whether the developer started a Claude conversation.^[0]

The remote-access component attempted to place an attacker-controlled key in the victim's SSH configuration and establish reverse tunnels. Persistence mechanisms differed by operating system: a LaunchAgent on macOS, and scheduled tasks requesting system privileges plus a fallback Startup script on Windows. These details describe payload intent and attempted behavior; the report does not establish successful installation of each mechanism.^[0]

Administrative rights were a significant constraint on the SSH backdoor path. Cursor said turning on the local SSH service required administrative privileges, which the extension had only in highly unusual circumstances. This constraint limits conclusions about successful remote access, but it does not eliminate the separate metadata-exfiltration behavior.^[0]

Reported exfiltration covered hostnames, usernames, operating systems, OS architectures, home-directory paths, environment variable names, working directories, configured Git email addresses, and public IP addresses. The article describes theft of environment variable names, not their values, and does not substantiate broader claims that credentials, source code, or secret contents were stolen.^[0]

Affected versions and patch status

Key takeaways

• Treat metadata theft and persistent remote access as separate impact questions. The report describes metadata exfiltration, while successful SSH access depended on conditions Cursor characterized as highly unusual.^[0]
• The small size of the reported modification did not imply limited capability: a 66-line addition executed at extension load and attempted both data theft and persistent access while preserving the legitimate extension's remaining code.^[0]
• The initial intrusion remains unresolved in the supplied evidence. The article's discussion of stolen publishing credentials describes a historical pattern, not a confirmed explanation for this compromise.^[0]
• The evidence provides a malicious extension version and exposure window, but no actionable attacker domain, IP address, file hash, SSH key, or uniquely named persistence artifact. The separate embedded-browser research must not be merged into this incident's attack chain.^[0]

Defensive actions

• Assess exposure using the extension identity, malicious version, and distribution window.: Review extension inventory and available installation or update records for Claude Code version 2.1.313 delivered through Cursor between 09:27 and 20:35 GMT on October 29, 2026. These are the concrete exposure criteria reported by Cursor; its planned direct notifications provide another incident-specific source for identifying affected users.^[0]
• Inspect exposed endpoints for unauthorized SSH configuration changes and reverse-tunnel activity.: The payload attempted to add an attacker-controlled SSH key and create reverse tunnels. Determine whether those changes or connections actually succeeded rather than treating installation of the malicious extension as proof of a functioning backdoor.^[0]
• Review the operating-system-specific persistence locations described in the report.: On exposed macOS systems, examine LaunchAgents for activity associated with the malicious extension. On Windows, examine scheduled tasks, including tasks configured for system privileges, and Startup scripts. These are the persistence mechanisms the payload reportedly attempted; no incident-specific names or paths are supplied.^[0]
• Investigate metadata exfiltration even where the SSH backdoor could not be established.: Cursor's administrative-privilege limitation applies to enabling local SSH, while the malicious extension separately transmitted metadata through Web requests. Review available extension-process and network telemetry with that distinction in mind. Scope the reported data exposure to the listed fields rather than assuming environment variable values or other secrets were stolen.^[0]
• For the affected distribution service, validate containment across publishing credentials and other hosted extensions.: Cursor's reported response included rotating keys, checking other extensions for tampering, taking the marketplace offline and rebuilding it, and working with the hosting provider to remove attacker infrastructure. These measures address the compromised distribution channel, although the report does not establish which initial-access mechanism made them necessary.^[0]