The Cursor marketplace extension backdoor was live for about eleven hours. According to Cursor’s own security notice, a maliciously modified version of Anthropic’s Claude Code extension was available between roughly 2:27am and 1:35pm Pacific on 29 October, with the indicators of compromise updated the next morning.
Versions 2.1.312 and 2.1.313 are affected, covering Windows and macOS packages. Cursor states the builds “were not developed by Anthropic”, and Microsoft confirmed its own Visual Studio Marketplace and the npm distribution were untouched.
What the Cursor marketplace extension backdoor attempted
On load, the injected code collected hostname, username, operating system, architecture and public IP and sent them out. It then attempted to open a route back in: writing an attacker-controlled key into authorized_keys, switching on the local SSH service and establishing a reverse tunnel, with background scripts retrying roughly once a minute.
Persistence was handled differently per platform, through a LaunchAgent on macOS and a scheduled task with a startup-script fallback on Windows. The key itself was named svc-telemetry, which reads as ordinary instrumentation at a glance.
Whether it actually worked is a separate question
Cursor notes the SSH steps generally require administrator rights that the extension does not hold on a standard account, so on most machines they would fail. Microsoft frames it the same way, saying attempted execution does not establish a successful compromise and that the outcome turns on host privileges and local SSH setup.
The more awkward detail is that removing the extension may not be sufficient, because standalone persistence scripts could still be running independently of it.
One practical consequence is that the window matters less than the audit. Eleven hours is short, but an extension installs once and runs every time the editor opens, so the relevant question is who installed or auto-updated during that window rather than who was using Cursor across it.
The response was unusually broad
Rather than delist one package, Cursor took the entire marketplace offline. It then audited access and confirmed no other extension had been altered, rotated keys, rebuilt the marketplace and restored it. It also worked with the hosting provider to remove the attacker’s server, and says that server “no longer functions”.
Remediation scripts for both platforms and a list of indicators of compromise are published in the notice itself, along with advice to rotate any credentials an affected host could reach.
What Cursor has not explained is how the attacker got the access to publish under Anthropic’s name in the first place. Until that is answered, the audit is a statement about what was found rather than about how it happened.
Why editor extensions are worth attacking
An extension inherits the privileges of the developer running it, and a developer machine typically holds keys to repositories, cloud accounts and production systems. That is a short path from a plugin listing to infrastructure, which is why eleven hours of exposure is treated as serious.
The same week supplied a parallel: the Binance theft began, by the exchange’s own first account, with a compromised engineer laptop. Our notes on cloud security practice cover the credential rotation this kind of incident forces.
