What actually happened
On October 29, a tampered build of Anthropic's Claude Code extension was distributed through Cursor's extension marketplace for about 11 hours, from 09:27 to 20:35 UTC. Cursor initially singled out version 2.1.313, then updated its advisory on October 30 to include 2.1.312. The affected packages were for macOS and Windows. Cursor estimates that up to 5,000 users received the malicious software.
The injected code ran as the extension loaded, without anyone asking the AI assistant to perform a task. It tried to append an attacker-controlled SSH key, enable SSH, create a reverse tunnel and install startup persistence. It also collected machine details, Git email addresses and names of environment variables. The payload was not built by Anthropic.
Cursor removed the packages, audited its marketplace and worked with the hosting provider to disable the attacker's server. Microsoft reports that its own VS Code marketplace and the official Claude Code npm distribution were not affected.
Why a small team cares
Consider a solo developer maintaining an online shop and its integrations from one laptop. That machine may have access to source repositories, production deployments, payment-service dashboards and customer data. A malicious editor extension running under the developer's account can reach valuable local files regardless of whether the AI agent was ever granted permission to use them.
This is a software supply-chain incident, not an example of an agent following a dangerous prompt. The extension executed code on load. The distinction matters because tightening agent prompts or confirmation settings would not have stopped that installer from running.
The clearest indicator is an unauthorized key labeled svc-telemetry in the user's SSH authorized_keys file. Cursor also documents separate persistence files, including a macOS LaunchAgent and Windows startup scripts. Removing or updating the extension alone does not remove these artifacts. An exposed machine may therefore need investigation, cleanup and credential rotation from another trusted device.
Hype vs useful
Up to 5,000 exposed users is not the same as 5,000 successful remote compromises. Cursor says mistakes in the malware's SSH setup prevented login on most ordinary macOS and Windows machines. The extension could still plant its key, install persistence and send reconnaissance information, so affected installations require remediation even when no remote session is known.
A useful response is targeted rather than indiscriminate. Prioritize anyone who installed or automatically updated the named extension from Cursor during the October 29 window. Use Cursor's published indicators and platform-specific cleanup scripts, then check whether reachable SSH keys, API tokens and active sessions need revocation. Developers who used unaffected distribution channels should not interpret the incident as proof that Claude Code itself was breached.
