# News: Modified copies of the official Claude Code extension reached Cursor's marketplace and installed an SSH backdoor, with Cursor reporting up to 5,000 users affected

> Cursor's security notice (29 October, updated 30 October) says versions 2.1.312 and 2.1.313 of the official Anthropic.claude-code extension were modified inside the Cursor VS Code Extension Marketplace on 29 October to install an SSH backdoor and persistence mechanisms. The malicious versions were installable on macOS and Windows between 2:27am PT and 1:35pm PT that day, and Cursor says up to 5,000 users were affected. Cursor rotated keys, rebuilt the marketplace, and worked with the hosting provider to take the attacker's server offline; it warns that uninstalling the extension may not be enough because the payload drops standalone persistence scripts, and publishes indicators plus a check script for buyers to run.

Human page: https://testedactually.com/news/cursor-marketplace-claude-code-backdoor/
Mirror: https://testedactually.com/news/cursor-marketplace-claude-code-backdoor.md
Published: 2026-10-31

## What changed

Cursor's security notice (29 October, updated 30 October) says versions 2.1.312 and 2.1.313 of the official Anthropic.claude-code extension were modified inside the Cursor VS Code Extension Marketplace on 29 October to install an SSH backdoor and persistence mechanisms. The malicious versions were installable on macOS and Windows between 2:27am PT and 1:35pm PT that day, and Cursor says up to 5,000 users were affected. Cursor rotated keys, rebuilt the marketplace, and worked with the hosting provider to take the attacker's server offline; it warns that uninstalling the extension may not be enough because the payload drops standalone persistence scripts, and publishes indicators plus a check script for buyers to run.

## What it means for buyers

This is the second agent-tooling security incident this week (after the embedded-browser flaw disclosures we covered on 29-30 October), and it hits the highest-trust surface a developer has: an extension wrapping a coding agent that reads whole repositories and runs shell commands. Buyers should treat AI-tool extension marketplaces as supply-chain surface - pin extension versions, run Cursor's published check script if they installed anything in the window, and audit for SSH keys and scheduled tasks even after uninstalling. As agent extensions carry more credentials, vendor incident response quality (Cursor published IOCs, rebuilt the marketplace, and scoped versions within a day) becomes a selection criterion our ai-coding-assistants table does not yet score.

## Sources

- [1] Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace (Cursor) - https://cursor.com/blog/claude-code-extension-security-notice (vendor security notice with affected versions, install window, IOCs and remediation steps, published 29 October 2026 and updated 30 October 2026, checked 2026-10-31)

TestedActually tracks pricing and programme changes as dated, sourced events: https://testedactually.com/news/.