Cursor is warning developers who installed malicious Claude Code extensions from its marketplace that removing the extensions may not be enough to secure their computers. Affected devices may need to be checked for leftover components, while credentials and sessions accessible from those machines should be rotated from a trusted system. The incident involved versions 2.1.312 and 2.1.313 of Anthropic.claude-code for macOS and Windows. Whether an attacker could gain access depended on the affected device’s configuration and permissions.
Malicious versions appeared on October 29
Cursor’s security notice said the two versions were available in its marketplace from about 2:27 a.m. to 1:35 p.m. Pacific Time on October 29, 2026. The company said Anthropic did not develop the malicious versions and that it had found no evidence that other versions or official distribution channels were affected.
Cursor added details about the affected versions and ways to identify them on October 30. Security researcher Phorion initially identified version 2.1.313, then updated the analysis on October 31 to include version 2.1.312.
Payload attempted to establish SSH access
Phorion’s analysis found that the payload attempted to add an SSH key controlled by the attacker, enable SSH remote login on the device and create a reverse tunnel. If the SSH service was running, the planted key could potentially let an attacker log in through that tunnel. The code also tried to maintain access: on macOS, it used a LaunchAgent; on Windows, it attempted to create a scheduled task, with the Startup folder as a fallback if that failed.
The code ran when Node loaded the extension module, Phorion said. It did not need to wait for the extension’s normal activation callback or for the user to take another action. Successful remote access still depended on the state of the host. Researchers found a permissions issue in the macOS code: running as a standard user could prevent it from enabling remote login. However, if SSH was already enabled or was enabled later, the planted key could still provide a route in while the tunnel was active.
Server shutdown does not remove local components
Cursor said it worked with its hosting provider to shut down the attacker’s servers, removed the malicious extensions, rotated its own keys and rebuilt the marketplace before reopening it. Those steps do not automatically remove components that may have been left on affected computers.
Phorion said the initial beacon sent back host information and the names of up to 40 matching environment variables, but not the secret values stored in them. Cursor cautioned that this limited collection did not rule out the possibility that an attacker later obtained credentials through the backdoor.
Cursor advised users to review terminal, network and extension-installation records. If there are signs that the payload ran or a backdoor was installed, users should isolate the device and remove unauthorized SSH keys, persistence mechanisms and active tunnels. The company’s notice includes remediation scripts for different operating systems and recommends assessing whether a host needs to be reinstalled or rebuilt.
Users should also rotate credentials and sessions that the affected host could access, using a trusted device. For developers, these could include credentials for development tools or financial services available to a local account. Neither Cursor’s notice nor Phorion’s analysis confirmed cryptocurrency theft or established that the attack specifically targeted the cryptocurrency industry.