Cursor pulls Claude Code malware, says up to 5,000 users affected

Cursor removed tampered copies of Anthropic’s Claude Code extension after an 29 October 2026 incident that the marketplace operator says affected at most 5,000 users. The packages used the coding assistant’s legitimate extension identity, so developers could receive the malware as an update rather than as a separate imitation.

Cursor’s updated security notice identifies versions 2.1.312 and 2.1.313, with confirmed packages for macOS ARM64 processors and Windows x64 processors. The malicious updates were available for approximately 11 hours, from about 02:27 to 13:35 Pacific Daylight Time on 29 October [13:27 29 October to 00:35 30 October Yerevan time], Cursor said.

The user ceiling is not a count of successful attacker logins. Microsoft’s analysis says remote access depended on administrator privileges, the workstation’s remote-access settings and the attacker’s server configuration. Malicious keys and startup scripts could remain even when access failed.

What the malicious extension tried to do

Microsoft found that the inserted code runs when the extension loads, before its normal startup code. It attempts to create a backdoor using Secure Shell, or SSH, a tool for remote login. An unauthorized SSH key would let its holder access the developer’s account if the local SSH service allowed it.

The malware also attempts an outbound reverse tunnel: a connection from the workstation to the attacker’s server that provides a route back into the workstation. Successful access could let the attacker run commands or transfer files. Startup scripts attempt to restore that connection after it stops or the user logs in again.

Cursor said enabling SSH required administrator rights that the extension lacked on most macOS and Windows hosts, preventing login through the tunnel on those machines. It said the extension nevertheless added the attacker’s key, installed startup mechanisms and sent host details, making cleanup necessary.

Phorion’s analysis, described by BleepingComputer on 30 October, identified additional setup errors. On macOS, a permissions error caused the malware to skip enabling remote login. On Windows, it tried to use a Unix command shell unavailable on standard installations. These failures did not prevent key installation or startup changes, and did not protect machines where SSH was already running.

Cursor said the malware sent computer and user names, operating-system details, directory paths, the configured Git email address and the public IP address. Microsoft found that it sent selected environment-variable names, not their values. These variables are software settings that can hold credentials; their names reveal configuration categories but do not demonstrate theft of the secrets themselves.

How to check and clean an affected device

Developers who installed or automatically updated the affected packages should consult Cursor’s security notice. It supplies package fingerprints—digital identifiers for matching files—and checks for the attacker’s SSH authorization key, labeled svc-telemetry. Cursor says finding that key confirms impact. Microsoft cautions that a missing label alone is not enough to clear a device; installation records, running processes, network activity and startup changes also need review.

Updating or uninstalling the extension alone does not remove malicious files written outside its installation folder. Microsoft advises preserving evidence before cleanup. Cursor recommends these steps:

1. Isolate devices showing evidence that the malicious code ran or installed a backdoor.
2. Remove the unauthorized SSH key, malicious startup mechanisms and running tunnel processes. Assess whether the device needs rebuilding.
3. From a trusted system, replace credentials and revoke or renew sessions accessible from the affected device. Limited collection of environment-variable names does not rule out later credential access through the backdoor.

Cursor says the scripts remove the malicious extension, startup mechanisms, tunnel processes and attacker key, and return an error status if anything remains. Microsoft advises reviewing the scripts before use and verifying that the malicious files and startup entries do not return after login or restart.

The companies' response and the remaining investigation

Cursor said it blocked distribution immediately after detection and shut down the marketplace. It then audited access, confirmed that no other extensions had been tampered with, rotated its own keys, rebuilt the marketplace and restored service. It also worked with the hosting provider to take the attacker’s server offline, disabling the reverse connection and information reporting to that server. Microsoft warns that the takedown does not remove changes already made to devices.

Anthropic technical staff member Felix Rieseberg said on 30 October that the company was working with Cursor and denied that Anthropic’s systems or employee laptops had been compromised. In a statement carried by The Register, he said an attacker used access to Cursor’s marketplace to publish a tampered copy that Anthropic neither built nor published. The attacker’s identity and the exact way the package reached the legitimate extension identity remain unknown.

Microsoft confirmed that its Visual Studio Marketplace and the Claude Code npm distribution did not distribute the malicious packages. The Hacker News corrected its initial attribution to Open VSX and said there was no evidence the malicious update reached that registry. It also reported that Anthropic had published the clean version 2.1.314 to Open VSX and Microsoft’s marketplace by 30 October 2026, and that no other follow-on payloads had been observed.

Microsoft’s recovery guidance calls for reviewing remote-login, command and file activity on affected devices to determine whether further access occurred. Cursor said it would contact impacted users directly.