Correct Publisher Name, Malicious Build: The Cursor Marketplace Extension Incident

On 29 October 2026 Cursor published a security notice about its extension marketplace. For roughly eleven hours that day, from about 2:27am to 1:35pm Pacific time, the Cursor VS Code Extension Marketplace served "a maliciously modified version of Anthropic's Claude Code extension", versions 2.1.312 and 2.1.313 for Windows and macOS. Cursor is explicit that "These malicious versions of the extension were not developed by Anthropic."

This is not a story about a bug in an editor or a poisoned dependency. It's about the distribution channel itself: a marketplace served a malicious build under a real, trusted publisher name. That makes it a useful lesson for anyone who installs extensions, which is nearly every developer.

What the malicious build did

Cursor and Phorion, a security company that sells endpoint detection software and published a technical analysis on 30 October, describe the same behaviour:

• It ran on load. According to Phorion, the malicious code was prepended to the extension's main file and executes as soon as the editor loads it: "The user doesn't need to interact with the extension for the payload to fire."
• It planted an SSH key. It added an attacker-controlled key to the user's ~/.ssh/authorized_keys, under the comment svc-telemetry.
• It tried to open a way back in. It attempted to enable the local SSH service and hold open a reverse SSH tunnel to the attacker's server, and set up persistence so the tunnel would come back after a restart.
• It reported on the machine. Hostname, user, OS, Git email, public IP, and the names (not the values) of environment variables that look like keys or tokens.

Why it was less bad than it could have been

The attack was partly broken by its own mistakes. Cursor says the step that turns on the local SSH service would fail "Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code". Phorion found one of the reasons: on a Mac, the script checks whether Remote Login is off without the permissions needed to read that setting, gets an error message back, and so never tries to turn it on. In Phorion's words, "On a Mac that doesn't already have SSH running, that mistake breaks the inbound access path".

Cursor also worked with the hosting provider to take the attacker's server offline. It removed the versions, shut the whole marketplace down as a precaution, rotated its keys and rebuilt it. It says it "confirmed no other extensions were tampered with", and that it has "no evidence that other versions of the extension or the official distribution are affected."

But "partly broken" is not "harmless". Cursor is direct about what still happened on affected machines: "The extension added the attacker's SSH key, installed persistence, and sent host details to the attacker." And it warns that "Uninstalling the extension may not be sufficient", because the persistence scripts keep running on their own.

The lesson: a publisher name is not a guarantee

Every extension marketplace shows you who published an extension. That's an identity claim: it tells you which account the listing belongs to. It doesn't, by itself, prove that the file you download is the file that publisher built. Here the name on the listing was the real one, and the build was not.

Two things make that matter more for extensions than for most software:

• Extensions run with your editor's permissions. That usually means your files, your source code, your SSH keys and your shell, often the most sensitive access on a developer's machine.
• The trust is spent at install, not at use. This code ran when the editor loaded it. There was no later moment to notice something odd before it acted.

What to do

• If you use Cursor and installed or updated that extension on 29 October: follow Cursor's notice, which includes a check script, remediation scripts for macOS and Windows, and a full list of indicators. It also advises rotating credentials reachable from affected machines.
• Check by key, not just by label. The simplest check looks for the svc-telemetry comment. Cursor also publishes the key's fingerprint, and Phorion suggests checking "the public-key fingerprint rather than relying solely on the comment string", since a comment is easy to change.
• Know where your editor gets its extensions. Different editors use different marketplaces, even for extensions with the same name. It's worth knowing which one yours uses.
• Pin and review extension updates on important machines. Automatic updates mean a bad build reaches you without a decision on your part. On machines with access to production or client systems, consider updating deliberately.
• Look at authorized_keys now and then. Any key you don't recognise in that file is a door someone else holds a key to.

Sources: Cursor, "Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace" (29 October 2026, updated 30 October; read 31 October 2026); Phorion, "Official Claude Code Extension Compromise: Security Advisory" (30 October 2026, updated 31 October; read 31 October 2026). Phorion sells endpoint detection and response software.