AI Policy & Safety

How a Fake Claude Extension on Cursor Stole Developer Data

By The Agent5 founder·November 3, 2026·How we fact-check

On October 29, 2026, a malicious copy of Anthropic's Claude Code extension sat inside Cursor's extension marketplace for roughly eleven hours, exposing up to 5,000 developers to data theft and persistent SSH backdoors. The incident is a textbook supply chain attack, and it reveals a security gap that affects every developer who trusts an AI coding tool.

ShareX LinkedIn WhatsApp

Key takeaways

A trojanized version of the Claude Code extension was live in Cursor's marketplace for approximately eleven hours on October 29, 2026, affecting up to 5,000 developers before removal.
The malware ran automatically on extension load with no user interaction, harvesting system data and attempting to plant a persistent SSH backdoor using just 66 lines of injected JavaScript.
Coding errors in the malware limited the SSH tunnel's effectiveness on most machines, but the attacker's SSH key and persistence scripts could still be installed even when the tunnel failed, and removing the extension alone does not clean up those artifacts.
Anthropic's own systems, the Visual Studio Marketplace, Open VSX, and the npm package were all confirmed unaffected; the incident was isolated to Cursor's marketplace.
The attack is a clear example of how AI coding tool marketplaces have become high-value software supply chain targets, and it has renewed calls for mandatory code signing and publisher verification in extension ecosystems.

On October 29, 2026, thousands of developers opened their AI-powered code editor and, without clicking anything unusual, loaded malware onto their machines. The culprit was not a phishing email or a cracked tool from a shady forum. It was a tampered version of a widely trusted, officially branded extension sitting inside a mainstream marketplace. The incident is brief in duration but significant in what it reveals about how AI coding tools have become a new front in software supply chain attacks.

What Is Cursor, and Why Does Its Marketplace Matter?

Cursor is an AI-powered code editor built on the same foundation as Visual Studio Code. Because it is VS Code-compatible, it runs a marketplace of extensions, small software packages that add features to the editor. Developers routinely install extensions to gain language support, linters, formatters, AI assistants, and more. Extensions run with the same system-level privileges as the editor itself, meaning a malicious extension can read files, make network connections, and modify system configuration without asking for additional permission. That combination of trust and privilege makes extension marketplaces a high-value target.

The Claude Code extension is Anthropic's official integration for VS Code-compatible editors. It brings Anthropic's AI coding assistant directly into the editor so developers can write and debug code using natural-language instructions. It is exactly the kind of widely installed, frequently updated tool an attacker would want to impersonate.

The Timeline: Eleven Hours of Exposure

According to Cursor's own security notice, a maliciously modified version of the Claude Code extension was made available in the Cursor VS Code Extension Marketplace between approximately 2:27 a.m. PT and 1:35 p.m. PT on October 29, 2026. The affected versions were labeled 2.1.312 and 2.1.313 under the identifier anthropic.claude-code. According to security analyses, the affected builds targeted darwin-arm64 (macOS Apple Silicon) and win32-x64 (Windows x64); Phorion's advisory also identified Linux as a targeted platform. Cursor estimated that at most 5,000 users were affected during that window, and the company said it would contact those users directly.

Importantly, Anthropic had no involvement. Cursor's notice stated plainly that those malicious versions were not developed by Anthropic. Felix Rieseberg of Anthropic confirmed on social media that the versions on the company's official channels, including Visual Studio Marketplace and Open VSX, were not affected, and that the incident was limited to Cursor users. Microsoft Threat Intelligence subsequently confirmed that the malicious packages were never published through Microsoft's Visual Studio Marketplace or the npm registry for the Claude Code package, and that all evidence pointed to the compromise being isolated to Cursor's marketplace.

How the Attack Got In

How the tampered build reached the marketplace in the first place is still not fully explained publicly. According to analysis from Anthropic and third-party security researchers, a malicious actor used access to Cursor's marketplace to publish the tampered extension. One leading explanation across multiple security analyses is that the attacker likely obtained a publisher access token, which is the credential required to push extension updates to the marketplace. Researchers at Wiz had previously documented that leaked access tokens are a recurring problem across VS Code-compatible marketplaces, with valid tokens sometimes embedded inside extensions themselves.

Because the trojanized build was published under the legitimate extension's identifier, any developer who had Claude Code installed and received an automatic update during those eleven hours would have pulled in the malicious version without any manual action. The attacker abused the same distribution slot used by the legitimate extension, so a routine update was all that was needed to trigger the attack.

What the Malicious Code Actually Did

Security firms Phorion and OpenSourceMalware each published detailed analyses of the tampered extension. Researchers found that the attacker inserted a malicious JavaScript loader at the beginning of the extension's extension.js file, though specific findings in the analyses below are attributed to the firm that reported them. Specifically, the injected code took the form of an immediately invoked function expression, a common JavaScript pattern, prepended to the minified extension bundle. The rest of the file looked entirely normal.

The malicious code executed as soon as the extension loaded, with no interaction required from the user. Once active, it carried out several actions. First, it harvested reconnaissance data from the host machine, including the username, hostname, public IP address, operating system, OS architecture, home directory path, environment variable names, configured Git email addresses, and working directory. This data was sent unencrypted over HTTP to a remote server at IP address 134.209.82.225.

Second, the malware attempted to add an attacker-controlled SSH key to the user's authorized_keys file, enable the local SSH service, and open a reverse SSH tunnel back to the same remote server. If that tunnel had been successfully established, the attacker would have had a persistent, interactive shell on the developer's machine, capable of reading source code, credentials, and other sensitive files.

The malicious loader was just 66 lines of code. Its footprint was small, its intent was serious.

Why the SSH Backdoor Largely Failed (But Still Mattered)

The SSH tunnel, which was the most dangerous part of the payload, was limited in its effectiveness by coding errors in the malware itself and by privilege requirements on target operating systems. Cursor noted that enabling the local SSH service would generally fail without administrator privileges on affected Windows and macOS machines. Phorion independently identified a flaw specific to the macOS code path that would prevent the SSH-enable step from running correctly in many cases.

However, the failure of the tunnel did not make the attack harmless. Even on machines where the SSH backdoor could not be fully established, the malware could still plant the attacker's SSH key in the authorized_keys file and install persistence mechanisms that would outlast the extension itself. The reconnaissance data, including Git email addresses and environment variable names pointing to cloud credentials, was transmitted regardless. Phorion specifically warned that uninstalling the extension is not sufficient to remove the backdoor, because the payload drops standalone persistence scripts that keep running independently of Cursor.

According to OX Security's analysis, the key planted in authorized_keys was labeled with the comment svc-telemetry, a name designed to look like a system service entry rather than an attacker's key.

Cursor's Response and the Marketplace Shutdown

Once the malicious extension was discovered, Cursor moved quickly. According to OX Security's analysis, Cursor removed the malicious versions, temporarily shut down its entire extension marketplace to audit other extensions, rotated its access keys, worked with the cloud provider hosting the attacker's server to take that server offline, and then rebuilt and reopened the marketplace. Cursor stated it found no evidence that any other extension versions or the official distribution were affected.

Cursor also published platform-specific remediation guidance and a cleanup script, advising affected users to inspect their SSH authorized_keys file for an entry labeled svc-telemetry and to follow the official steps to remove any persistence artifacts. The remediation was explicit that simply removing the extension through the Cursor interface was not enough.

Microsoft's security blog published its own analysis of the JavaScript embedded in the malicious extension, providing additional technical detail for enterprise security teams. StepSecurity deployed a scanning rule specifically to detect the malicious extension.js file from versions 2.1.312 and 2.1.313.

The Bigger Picture: AI Tools as Supply Chain Targets

This incident did not happen in isolation. Extension marketplace security has been a growing concern across the developer tooling ecosystem. OX Security researchers previously documented that verified extensions in multiple IDE marketplaces can be modified after receiving a verification badge while still retaining their trusted status, and demonstrated this on the Visual Studio Marketplace. Separately, Cursor itself acknowledged in prior research that it does not continuously verify extensions once they are installed. A distinct earlier incident involved a fake Solidity language extension on Open VSX that was used to steal cryptocurrency from a developer, showing that AI coding tool marketplaces had already attracted financially motivated attackers.

The Claude Code incident fits a pattern security researchers call a software supply chain attack. Rather than attacking the end user directly, the attacker compromised the distribution channel for trusted software. The developer's trust in the marketplace, the official-looking extension name, the automatic update mechanism, all of these features that make software convenient also made the attack effective. As AI-assisted IDEs become standard in enterprise development workflows, their extension marketplaces become more attractive as entry points. A single poisoned extension can reach thousands of developer machines in hours, and developer machines are particularly valuable targets because they hold source code, cloud credentials, signing keys, and repository access tokens.

Security researchers have called for extension marketplaces to adopt mandatory code review before publication, automated scanning of newly submitted extension bundles, cryptographic code signing tied to publisher identity, and per-file hash validation. Some of these controls exist in partial form on some platforms, but the Claude Code incident shows that gaps remain, particularly on newer, faster-growing AI-focused marketplaces.

What Developers and Organizations Should Watch For Next

Cursor has said it will contact the up to 5,000 users who may have been affected and has published official remediation steps. Several threads remain open. The method by which the attacker gained publishing access to Cursor's marketplace has not been fully disclosed. No attribution for the attack has been made public. Cursor has not yet detailed what additional marketplace security controls it intends to implement going forward.

Regulatory scrutiny of software supply chains is also increasing. The European Union's NIS2 Directive, whose transposition deadline for EU member states was October 17, 2024, requires organizations to address security risks in their supply chains and to maintain incident response capabilities. Security analysts have pointed to this incident as a concrete example of the kinds of supply chain failures NIS2 was designed to address.

For developers and enterprise security teams, the practical items to watch include any update to Cursor's marketplace security policies, further technical disclosures from Phorion, OpenSourceMalware, or Microsoft's threat intelligence team, and any industry-wide responses to the question of how extension publisher identity should be verified before a build reaches users. The Claude Code compromise is unlikely to be the last attack of its kind, and the security community's response to it will shape how safe developer tooling is for the next cycle of AI coding tools.

Sources

Frequently asked questions

No. Anthropic's own systems were not compromised. The malicious extension was not developed or published by Anthropic. It was distributed solely through Cursor's own extension marketplace. Anthropic's official Claude Code packages on Visual Studio Marketplace and Open VSX were confirmed unaffected. Microsoft Threat Intelligence separately confirmed that the malicious packages were not distributed through the npm registry for the Claude Code package.

The attacker inserted a malicious JavaScript block at the very beginning of the extension's core file, extension.js, using a pattern called an immediately invoked function expression. This meant the malicious code ran automatically the moment Cursor loaded the extension, before any of the legitimate Claude Code functionality. No clicks, prompts, or user actions were needed to trigger it.

Yes. Even when the SSH tunnel could not be established, the malware still planted an attacker-controlled SSH key in the user's authorized_keys file and installed persistence scripts that continued running after the extension was removed. It also transmitted reconnaissance data including Git email addresses, usernames, hostnames, and environment variable names to a remote server, data that can be valuable for follow-on attacks.

Not on its own. Cursor and security researchers including Phorion explicitly warned that the payload drops standalone persistence scripts that keep running independently of the extension. Affected users need to follow Cursor's official remediation steps, which include checking the SSH authorized_keys file for an entry labeled svc-telemetry and running the cleanup script Cursor published.

In a typical scam, the attacker creates a fake lookalike. In this case, the attacker published a tampered build under the real extension's identifier, anthropic.claude-code, through the legitimate marketplace channel. Developers who already had the extension installed could have received it as a routine automatic update with no indication anything was wrong. This is a supply chain attack: the distribution infrastructure itself was the vector.

Security researchers recommend treating extension marketplaces with the same scrutiny applied to package registries like npm or PyPI. Practical steps include maintaining an inventory of installed extensions, restricting extensions to approved publishers, configuring extension update delays to allow time for community vetting of new versions, monitoring for unexpected SSH key additions or new background processes, and following any official security hardening guidance published by the IDE vendor.