By Tsuky 
The extension looked like a familiar programming tool. It carried the identity of Claude Code, Anthropic's coding assistant, and continued to perform its expected functions. But additional JavaScript embedded in the package attempted to turn the developer's workstation into a remotely accessible system.
The incident highlights a fundamental software supply-chain problem. Users do not necessarily need to run an obviously suspicious program to encounter malicious code. A trusted extension distribution channel can become the delivery mechanism.
In this case, installation or automatic updating could load the malicious extension without requiring the developer to issue a particular instruction to Claude Code.
The malicious packages were available for approximately eleven hours
Cursor says the affected packages were distributed between approximately 2:27 a.m. and 1:35 p.m. Pacific time on October 29.
The company's updated security notice and Microsoft's investigation identify versions 2.1.312 and 2.1.313 of anthropic.claude-code.
Cursor estimates that no more than 5,000 users were potentially affected.
That number is an exposure estimate, not proof that 5,000 machines were successfully accessed by the attacker.
Anthropic did not develop the malicious packages. Microsoft says the compromised versions were not distributed through the official Microsoft Visual Studio Marketplace or the relevant official Anthropic distribution channels.
Anthropic also told Microsoft that its own systems had not been compromised.
The available evidence points to the Cursor extension marketplace distribution channel rather than a general compromise of every Claude Code installation.
The injected code ran during extension loading
Researchers identified a malicious JavaScript loader placed before the extension's normal execution path.
When the module loaded, the injected function could collect host information, modify local files and run operating-system commands.
The legitimate extension continued working, reducing the chance that users would immediately notice something unusual.
The collected information included usernames, hostnames, operating system details, working directories and configured Git email addresses.
The loader also searched for environment-variable names associated with potentially sensitive configuration, including names referencing tokens, secrets and cloud credentials.
Microsoft makes an important distinction: the analyzed callback reported matching variable names rather than directly extracting their values.
That observation does not establish that the corresponding secrets were stolen.
However, a successful interactive compromise could create opportunities for additional data access, so investigations must consider subsequent activity rather than only the loader's initial reporting behavior.
The payload attempted to establish SSH access
The backdoor used Secure Shell, commonly known as SSH.
The loader attempted to insert an attacker-controlled public key into the affected user's SSH authorization file.
It then tried to enable the workstation's local SSH service and create an outbound connection to an external server.
That connection was intended to establish a reverse SSH tunnel.
In such an arrangement, the affected workstation initiates communication with a remote system rather than waiting for a direct inbound connection from the attacker.
If the local and remote services are configured appropriately, the resulting tunnel can provide a route back to the workstation.
However, the presence of the relevant code does not prove that the attacker obtained a working remote session.
Successful access depended on system privileges, SSH availability and the configuration of the remote infrastructure.
Implementation mistakes prevented access on many systems
The attack was limited by errors in its own implementation.
Cursor and independent security researchers report that the malware often failed to enable SSH on ordinary Windows and macOS installations.
On macOS, certain operations required administrator permissions that the extension ordinarily did not possess.
On Windows, problems with how the malware attempted to run commands also interfered with SSH service activation.
These limitations likely prevented many interactive connections.
They did not make the package harmless.
The loader could still add unauthorized SSH key material, create persistence artifacts and report system information.
Machines already running an SSH service, or using an editor launched with unusual privileges, could face different risks.
The total number of successful remote intrusions has not been established publicly.
Persistence mechanisms could survive extension removal
The malicious code attempted to remain active beyond the lifetime of the editor.
On macOS, it used a LaunchAgent to arrange repeated execution.
On Windows, it attempted to create a scheduled task and used a startup-script fallback.
Microsoft also documented Linux persistence behavior within the analyzed loader, although Cursor's principal notice concerned Windows and macOS packages.
The scripts attempted to reestablish the connection periodically, with retries roughly sixty seconds after failures.
These files and startup mechanisms could be created outside the extension installation directory.
Consequently, uninstalling or updating the extension does not necessarily remove the entire malicious payload.
That persistence capability is one of the main reasons affected users must follow a dedicated remediation process.
Cursor removed the packages and disabled the attack infrastructure
Cursor says it immediately removed the malicious releases from its marketplace.
The company temporarily shut down the entire extension marketplace while it investigated, audited other extensions, rotated keys and rebuilt the service.
It also worked with the hosting provider of the attack infrastructure to take the remote server offline.
That action disrupted the intended command-and-control connection.
However, disabling a remote server does not remove unauthorized keys, scripts or startup entries already created on a workstation.
Cursor's service recovery and an individual developer's device remediation are therefore separate tasks.
How potentially affected developers should investigate
The first question is whether Claude Code was installed or updated through the Cursor extension marketplace during the October 29 exposure window.
Users and security teams should check for versions 2.1.312 and 2.1.313, taking automatic updates into account.
The official advisories provide indicators of compromise associated with the injected code.
One notable artifact is an unauthorized SSH public key labeled svc-telemetry.
Microsoft recommends validating the key's cryptographic identity before removing an entry, rather than relying solely on its comment.
Investigations should also review suspicious startup mechanisms, SSH processes, outbound network activity and extension installation records.
A single matching filename is not necessarily proof of compromise.
Likewise, failing to find one specific artifact does not automatically establish that every relevant indicator has been checked.
Complete remediation requires more than uninstalling a plugin
Cursor has published platform-specific investigation and remediation instructions.
Microsoft recommends preserving useful evidence when malicious execution or persistence is suspected.
Remediation may include removing the trojanized extension, deleting confirmed unauthorized SSH keys, stopping malicious processes and removing associated startup mechanisms.
Administrators should take care not to delete legitimate SSH configuration or unrelated system services.
If the investigation indicates credential access, or the machine can no longer be trusted, credentials and sessions should be rotated or revoked from a known-clean device.
Some incidents may require rebuilding the workstation to restore confidence in its security.
Any remediation scripts should be obtained from official sources and reviewed before execution, especially when elevated privileges are required.
Developer extensions are a valuable supply-chain target
Extensions often have significant access to development environments.
They may read project files, interact with repositories and execute local commands as part of legitimate workflows.
Modern AI coding tools can require even greater integration to edit files, run tests and perform multi-step tasks.
Those capabilities make extension integrity especially important.
A recognizable publisher name or extension identifier does not, by itself, guarantee that the installed package is authentic.
Organizations can reduce exposure by restricting extension installation to approved publishers and delaying newly released updates when appropriate.
Such measures do not eliminate supply-chain risks, but they can reduce the number of machines exposed during a short-lived malicious publication.
The root cause of distribution remains an open question
Security researchers have established that malicious code was inserted into packages distributed under the Claude Code identity.
The evidence does not demonstrate that Anthropic authored the code or that its official distribution infrastructure was compromised.
Precisely how the attackers gained the ability to distribute the altered packages through Cursor remains a separate investigative question.
Public disclosures have not established definitive attribution to a particular threat actor.
The confirmed facts concern the malicious packages, their distribution window, their attempted behavior and the response taken by Cursor.
The risk can outlast the marketplace incident
The most important lesson from Microsoft's October 30 analysis is that ending distribution does not necessarily end an endpoint compromise.
A potentially affected organization must answer three different questions: Was the malicious extension installed? Did its injected code execute? Did the attacker obtain effective access?
Those answers may vary considerably between machines.
The incident demonstrates why AI-enabled development environments still depend on conventional software supply-chain security.
The immediate threat did not arise from an AI model generating an incorrect answer. It came from malicious executable code delivered through a trusted-looking extension channel.
For developers and security teams, the priorities are therefore clear: establish exposure, inspect the workstation, remove confirmed persistence and avoid treating an ordinary extension update as proof that the machine is safe again.