Cursor Extension Attack Shows Why Developer Marketplaces Need Stronger Controls
A developer extension can become a route into source code, credentials and cloud systems before anyone clicks a button. That’s the central lesson from malicious versions of Anthropic’s Claude Code extension, which appeared in Cursor’s VS Code extension marketplace on October 29 and attempted to establish persistent remote access.
Cursor said versions 2.1.312 and 2.1.313 were available for about 11 hours, from approximately 2:27 a.m. to 1:35 p.m. PT. The company removed them after detecting the tampering. The affected releases targeted Windows and macOS.
The incident involved Cursor’s marketplace, according to Anthropic technical staff member Felix Rieseberg. He said Anthropic’s systems and employee laptops weren’t compromised, and that versions distributed through Anthropic’s official channels were unaffected. Anthropic said it was working with Cursor.
Cursor’s security notice said the altered code tried to install an attacker-controlled SSH key, enable local SSH access and open a reverse tunnel to an external server. The versions weren’t developed by Anthropic. Rieseberg said an attacker used access to Cursor’s marketplace to publish them. Cursor and Anthropic had not responded to requests for comment by publication time.
Execution began when the extension loaded
Phorion’s analysis found that the malicious code sat at the start of the extension’s JavaScript file, ahead of the normal activation code. That placement let it run as the extension loaded, without requiring a developer to open or use it. “The user doesn’t need to interact with the extension for the payload to fire,” the security company said.
The payload tried to add an SSH key to the user’s authorized_keys file and connect to a remote server. It also created scripts and startup entries intended to preserve access across restarts. Phorion found implementation errors that could limit parts of the attack: on macOS, a check for the Remote Login setting required administrator privileges, so it could return an access error and cause the malware to skip enabling SSH. On Windows, a flaw could stop the SSH service setup command from running correctly.
Those failures didn’t eliminate the risk. Cursor said enabling SSH would generally fail without administrator privileges on affected machines, but the extension could still add the attacker’s key, create persistence mechanisms and transmit information about the host.
Microsoft Threat Intelligence reported that the malware gathered machine names, usernames, operating systems, working directories and Git email addresses. It also searched for environment variable names containing terms such as KEY, TOKEN, SECRET, PASS, AWS or GCP, recording up to 40 matches. Microsoft said the code collected the names of matching variables, not their values. Its analysis details the collection behavior.
Uninstalling may leave access behind
Removing the extension may not remove the scripts it placed outside the extension’s installation directory. Cursor warned that those components could persist after uninstall, leaving administrators to inspect the machine itself as well as the marketplace package.
Steve Povolny, Exabeam’s vice president of AI strategy and security research, said the planted key makes that distinction important: “Removing the extension only sends the visitor away while the spare key stays on the hook.” He recommended checking authorized SSH keys on systems reachable by affected developers, rotating credentials that may have been exposed and reviewing logs for logins tied to unfamiliar keys.
Phorion advised identifying the SSH key by its fingerprint rather than relying only on the comment “svc-telemetry” attached to it. Developers’ access to code repositories, cloud accounts and production systems can make a compromised workstation a bridge to other company resources.
Marketplace trust is part of supply chain security
For enterprises, the breach puts extension distribution on the same security agenda as other software dependencies. Yash Kadakia, founder and CTO of Security Brigade, described extension marketplaces as another part of the software supply chain. A malicious update arriving through a familiar marketplace, he said, challenges the assumption that a trusted distribution channel guarantees safe code.
Kadakia recommended stronger publisher checks, package integrity verification and controls over which extensions and versions developers can install. He also called for extension allowlists, managed updates, endpoint monitoring and limits on outbound connections. Short-lived credentials, isolated development environments and restricted access to sensitive infrastructure can reduce the damage if a developer machine is compromised.
Cursor said it removed the affected releases, temporarily closed its marketplace, audited access, rotated keys and rebuilt the marketplace before restoring it. The practical takeaway for engineering teams is to treat editor extensions as executable software: control what gets installed, monitor what it can reach, and have a response plan that checks for persistence after removal.
