Cursor has identified malicious versions of the Claude Code extension (Anthropic.claude-code 2.1.312 and 2.1.313) for macOS and Windows that were available in its marketplace on Oct. 29, 2026. The company says the extensions were not developed by Anthropic and that no other versions or the official distribution were affected.
Security researcher Phorion reported that the payload adds an attacker‑controlled SSH key, enables the SSH remote‑login service, and creates a reverse tunnel. Persistence mechanisms include a macOS LaunchAgent and a Windows scheduled task with a Startup‑folder fallback. The malicious code executes when Node loads the extension module, requiring no further interaction.
Uninstalling the extension may not remove these components. Cursor recommends a full host cleanup, removal of unauthorized SSH keys and persistence mechanisms, and rotating any credentials or sessions accessible from the affected machine using a trusted system. The company also advises checking endpoint, network, and installation logs, isolating compromised hosts, and considering a full system rebuild.
Cursor worked with its hosting provider to take the attacker server offline, removed the malicious packages, rotated its own keys, and restored the marketplace. While the initial beacon collected limited host information, Cursor cautions that further credential access cannot be ruled out. No evidence of cryptocurrency theft has been reported.
