Backdoored Anthropic coding extension on Cursor marketplace hit up to 5,000 users

A malicious version of Anthropic's official Claude Code extension was distributed through the marketplace of AI coding tool Cursor for nearly 12 hours on 29 October 2026, attempting to install a persistent SSH backdoor on the machines of up to 5,000 users who installed it, Ars Technica reported on 30 October, citing Cursor and independent researchers. The Hacker News separately reported the same incident, dating the exposure window to between 2:27 a.m. and 1:35 p.m. Pacific Time on 29 October.

What happened

• The compromised package, version 2.1.313, was published under Anthropic's official account on the Cursor marketplace and "effectively" replaced the legitimate version 2.1.312, security firm Phorian's chief technology officer told Ars Technica.
• Cursor said the malicious code attempted to add an attacker-controlled SSH key, enable the local SSH service and open a reverse SSH tunnel, with versions written for Windows, macOS and Linux, according to Ars Technica. Cursor said coding errors in the malicious package would have made the SSH-key step fail except where Cursor had been started with administrator privileges.
• The backdoor also collected host and user information — hostname, username, operating system, home directory path, environment-variable names, working directories, configured Git email and public IP — and reported it over HTTP, Ars Technica reported.
• Anthropic pushed a clean version, 2.1.314, several hours after the malicious release appeared, according to an independent researcher cited by Ars Technica.
• Cursor removed the backdoored package, shut down its marketplace temporarily to rotate keys and audit access, and worked with the hosting provider of the attacker's server to cut off infected devices, Ars Technica reported.

Why it matters

The incident shows that official extension marketplaces for AI coding assistants — now a routine part of software development workflows — can become a supply-chain attack surface, with a compromised account able to reach thousands of developer machines before anyone notices. Ars Technica reported that, as of its story, neither Cursor nor Anthropic had explained how the attacker gained control of Anthropic's distribution account, and that Anthropic had not yet issued a public notice to customers. For organisations anywhere, including in the Caspian region, that have adopted AI-assisted coding tools, the episode is a reminder to treat auto-updating editor extensions as part of the security perimeter requiring the same credential and access controls as any other software supply chain.