Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
A tampered extension distributed through Cursor’s marketplace attempted to establish persistent remote access on developer machines.
TL;DR
- A modified Claude Code VS Code extension was available in Cursor’s marketplace for about eleven hours on October 29.
- Cursor said the build attempted to add an attacker-controlled SSH key and open a reverse SSH tunnel; security reporting estimated up to 5,000 users may have obtained it.
- The number of affected installations and any successful access remain uncertain.
A modified build of Anthropic’s Claude Code extension appeared in Cursor’s extension marketplace on October 29. Phorion and follow-up reports describe a compromised marketplace distribution, not a compromise of Anthropic’s own release channel. [1] [2]
Cursor said the package attempted to add an attacker-controlled SSH key, enable local SSH access and create a reverse tunnel. Ars Technica said the listing was available for roughly eleven hours; BleepingComputer reported that up to 5,000 developers may have been exposed. [1] [2]
Reports distinguish the modified Cursor package from the official Microsoft Visual Studio Marketplace and Open VSX registries. The mechanism could leave persistence on a machine, so removing the extension alone may not address every affected host. [1] [2]
How many users installed or auto-updated to the affected build, and whether attackers used the access path, remain unknown. The reports establish malicious behavior and a limited distribution window, but not a confirmed victim count or public proof of follow-on intrusion. [1] [2]
Why it matters
AI coding tools operate inside developer environments with access to code and credentials. This incident puts extension distribution and updates within the AI software supply-chain risk surface.
Editor's note
Coverage agrees on the marketplace listing and attempted SSH persistence; the confirmed compromise count remains unknown.