Claude Code Extension Attack in Cursor's Store, Explained

Kaand Report Case File #002. Last updated October 31, 2026. This story is moving fast, and we will update this post as facts change. This is news and education, not security advice for your specific setup. Disclosure: this post was researched with Claude, which Anthropic makes. Anthropic is a party to this story, so we treat its statements as one side's account.

At 2:57 pm India time on October 29, a tampered build of the Claude Code extension went live in Cursor's extension marketplace. It carried the real extension name and stayed there until 2:05 am the next morning. Cursor says it tried to plant a persistent backdoor on developers' machines.

Then came the strange part. Cursor said at most 5,000 users were affected, then removed that number from its blog without saying so. Anthropic, whose name was on the extension, has published no official notice. And nobody has explained how the build got into the store.

Confirmed below means the party concerned said it, or two independent sources agree. Alleged means nobody has proven it.

Check this first

If you use Cursor on macOS or Windows and installed or updated the Claude Code extension in that window, treat your machine as affected until you have checked it. The affected versions are 2.1.312 and 2.1.313.

Use the check in Cursor's notice, and do not copy commands from anywhere else. Updating is not enough. Cursor says uninstalling "may not be sufficient", because the payload drops separate scripts that keep running.

This was not a vulnerability

Calling this a Claude Code vulnerability is wrong. Nothing in Claude Code was exploited, and we found no CVE. Someone put a modified copy of a trusted extension in a place developers trust, and normal updates did the rest. Phorion's CTO, Luke Roberts, told Ars Technica it was "a supply-chain compromise". Confirmed.

The change was small: a loader in front of the normal code. The real extension kept working, so a developer would see nothing odd. Microsoft says simply loading the extension was enough. Confirmed.

What the update tried to do

First, it noted machine details such as username, Git email and public IP.

Second, it collected the names of environment variables containing words like KEY, TOKEN or SECRET. Names, not values. Microsoft says this "does not demonstrate theft of the secrets stored in those variables". Phorion reads it as a shopping list for the attacker. Confirmed for the collection, alleged for the motive.

Third, it added the attacker's SSH key to the user's login file. That file works like a guest list: add a name and that person can walk in.

Fourth, it opened a reverse tunnel, so the laptop itself dials out and holds a line open. Startup items were meant to keep all this alive after a reboot, and after the extension was removed.

The attacker's own bug

The login only works if the machine's SSH service is on, and turning it on takes admin rights. Cursor says the extension lacks those on most macOS and Windows machines, and that this step fails because of errors in the malicious code. Phorion found the macOS bug: without admin rights, the system answers with an error instead of "Off", so the script never turns SSH on. Confirmed that Cursor says so. It has shown no data.

Phorion's CEO, Calum Hall, said the attackers "not fully understanding or testing their macOS malware seems to have bailed the industry out".

That comfort has limits. Cursor says the key, the startup items and the report home still landed. If SSH was already on, the bug does not help. In Phorion's words, "the backdoor is ready and waiting". Cursor says the attacker's server is now offline, but nobody has said whether anyone logged in before that. Unverified either way.

Three stories that do not fit

Anthropic's account. Felix Rieseberg, who works on Claude, wrote on X that it "wasn't a compromise of Anthropic's systems or employee laptops", and that someone "used access to Cursor's marketplace". Confirmed that he said it. No evidence has been shown.

Phorion's account. Roberts told Ars: "The malicious version 2.1.313 was posted to the official Anthropic account." Alleged. No proof has been published.

Cursor's account. There is none. Its notice says it "audited access", and "rotated our keys, rebuilt the marketplace, and brought it back online". It does not say what went wrong.

What can be checked points one way on where, but not on how. Open VSX, npm and Microsoft's marketplace have no record of 2.1.313. We checked Open VSX ourselves: 4,360 feed events from October 27 to 31, with no sign of it. Early reports, including Phorion's, wrongly named Open VSX as the source, and both Phorion and OpenSourceMalware corrected their blogs within hours. So the build appears only in Cursor's store. That does not prove how it arrived, or through whose access. Confirmed.

The number that disappeared

On October 30, Cursor said on X the incident was "impacting at most 5,000 users". Its blog said the same. The Wayback Machine's next capture, on October 31, has no number. Cursor's update note says it "clarified affected versions", and it does not mention the 5,000. There is no retraction, new figure or reason. Confirmed that it changed. Why is unknown.

The number may have gone stale when 2.1.312 was added, but that is our guess. A company can correct a number. It should say that it did. And that figure was a ceiling on people exposed, so "5,000 hacked" is wrong. No public count exists of machines that ran the code.

A long silence

Cursor's first dated public statement came about 11 hours after the window closed. The first public words we can find from Anthropic's engineers came about six hours after that.

Anthropic shipped 2.1.314 at 5:42 am India time on October 30, deliberately skipping 2.1.313, according to its security engineer David Dworken. So by our reading, it knew by then, about 14 hours before those first public words. As of October 31, we found no official notice from Anthropic. Ars reports that neither company answered its questions. Nothing here shows Anthropic was hacked. It does mean its users have heard nothing official.

Why stores are targets

Microsoft's docs say an extension has the same permissions as VS Code itself. It can read your files, run processes and make network calls. An update from a publisher you already trust raises no new question, so one poisoned version arrives with no decision from the user.

This has happened before. In May 2026, a malicious version of Nx Console was published with a stolen credential and reached users through normal updates. Attackers want the update channel, and a developer's laptop is worth reaching.

What to do

If you may be affected, follow Cursor's notice from a trusted machine. If the key is found, isolate the machine and rotate the credentials and sessions it could reach.

If you run a team:

Turn on Cursor's Marketplace Install Cooldown, which is off by default.
Use an allowlist for extensions, and keep fewer of them.
Treat developer laptops as a route into production.

What we still do not know

How the build got into Cursor's marketplace
Whether Cursor's systems were breached
Why the 5,000 figure was removed
How many machines really ran the code
Whether any attacker connected to any machine
Who did it. No public attribution exists

Case status: open

Cursor and Anthropic each hold part of this answer. When either gives it, we will reopen this case and update this post. If the facts prove us wrong, we will say so here.

Follow Kaand Report at @kaandreport on Instagram and YouTube for real hacks, properly explained.

Sources

From the companies

Investigations

Reporting and background

A Tampered Claude Code Update Sat in Cursor's Store for 11 Hours. Nobody Has Explained How.