A Tampered Claude Code Extension Sat in Cursor's Marketplace for 11 Hours. Up to 5,000 Developers Downloaded It.

Song "TELEMETRY" — Detroit rap, about three minutes, one story.

On Thursday, October 29, 2026, a tampered copy of Anthropic's Claude Code extension sat in Cursor's VS Code extension marketplace from about 2:27 a.m. to 1:35 p.m. Pacific — roughly eleven hours — as versions 2.1.312 and 2.1.313, built for macOS and Windows 1. Cursor says those versions were not developed by Anthropic, and estimates that at most 5,000 users downloaded the extension 2.

The payload was a short loader prepended to the top of the extension's extension.js, and it fired the moment that file loaded — no click, no prompt, before the extension's own startup code 3. It appended an attacker's Ed25519 key, commented svc-telemetry, to ~/.ssh/authorized_keys; dialled out to 134.209.82.225 as the user "tunnel" and asked that server to forward traffic back to port 22; installed persistence as a LaunchAgent named com.apple.sysmond on a Mac and as a scheduled task named SysMon on Windows; retried the connection about every sixty seconds; and sent back the hostname, username, OS, working directory, configured Git email, public IP and the names — only the names — of up to forty environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP 34.

What kept it from becoming a foothold was a mistake in its own code. On macOS the script ran systemsetup -getremotelogin without administrator rights; macOS answered "You need administrator access to run this tool", which the code read as anything but "Off", so the step that switches SSH on never ran. On Windows the command that installs the OpenSSH server went through a helper that hardcodes /bin/sh, a path Windows does not have 3. So on most machines the tunnel connected out and hit a closed port 22 — while the key, the persistence and the reconnaissance had already landed 1.

Anthropic says the incident did not involve a compromise of its systems or its employees' laptops, that the extension was not built or published by the company, and that its official channels are unaffected 5. Cursor removed the package, shut the marketplace while it audited every other extension, rotated its keys, rebuilt the marketplace, and worked with the hosting provider to take the attacker's server offline 1. Cursor has not explained how the upload got into its marketplace, and did not answer WIRED's question about whether Cursor itself was breached 2. No threat actor has been publicly identified, and no public report shows anyone actually getting in through the tunnel 6.

Uninstalling is not the same as cleaning up. Uninstalling the extension does not remove the SSH key or the persistence — the payload drops standalone scripts that keep running — so the login stays open until someone deletes it 7. The check Cursor published is to look for svc-telemetry in ~/.ssh/authorized_keys; where it turns up, the guidance is to isolate the host, remove the key and the persistence, and rotate the credentials it could reach 1. Anthropic released version 2.1.314 the next day; its release notes describe product fixes and say nothing about malware 6.

Reporting cut off at October 31, 2026. The next episode on this story is whatever Cursor says about how the upload happened, or the first named suspect.