Tampered Claude Code extension served from Cursor marketplace for about 11 hours
What happened
Two tampered versions of the Claude Code extension were available in Cursor's extension marketplace on 29 October. They collected host and user details and tried to add an attacker SSH key and a reverse tunnel. Cursor removed them and shut the marketplace down while it checked for other tampering.
CSO reports that versions 2.1.312 and 2.1.313 of the extension were available for about 11 hours on 29 October (Cursor's notice gives roughly 2:27am to 1:35pm PT). Cursor says they were not developed by Anthropic and that an attacker used access to its marketplace to publish them. The code collected machine names, usernames, operating systems, working directories and Git email addresses, and checked environment variable names containing words such as KEY or TOKEN without recording values. It tried to add an attacker key to authorized_keys, tried to open a reverse tunnel and set up persistence. Phorion found flaws that make the SSH step fail on some systems, and Cursor notes it generally needs administrator rights, while the other components can still work.
How it happened
Supply chain and access: Poisoned package. A malicious or tampered AI package, extension, plugin or MCP server was published and installed by users.
The AI involved was from Anthropic. The product was Claude Code VS Code extension, a type of coding assistant.
Impact
Data was exposed. Data involved: personal data. The impact was limited to a small number of people or a single system.
Severity is rated Low, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 29 Oct 2026. It became public on 29 Oct 2026, 0 days later.
Cursor removed the versions, temporarily shut down its marketplace, audited access, rotated keys and rebuilt the marketplace before restoring it. An Anthropic engineer said on X that Anthropic's official channels were unaffected, that only Cursor users were impacted and that Anthropic was working with Cursor.