Tampered Claude Code extension tried to plant an SSH backdoor via Cursor's marketplace

Cursor says a maliciously modified 2.1.313 was live from about 2:27am to 1:35pm PT on October 29 and that at most 5,000 users were affected. Per Cursor, the code collected hostname, username, home directory, environment variable names, configured Git email and public IP, then tried to append an SSH key labeled svc-telemetry to authorized_keys, open a reverse tunnel, and persist through a LaunchAgent on macOS or a scheduled task on Windows. Cursor says the attacker's server has been taken offline, that the enablement step would fail on most hosts without admin rights, and that it has no evidence other versions or the official distribution are affected. Its guidance: uninstalling "may not be sufficient" because the payload drops standalone persistence scripts, and credentials reachable from an affected machine should be rotated.

Phorion's analysis (Calum Hall, October 30) adds that the payload is prepended to the bundle and runs when the file loads, before the extension's activate callback. It also found a bug on macOS: systemsetup -getremotelogin run without privileges prints an error rather than "Off", so the script skips turning SSH on. Phorion notes that is not a defense, since the key and persistence are still dropped.

Who is responsible is disputed. Cursor says the build "was not developed by Anthropic." Kevin Beaumont (DoublePulsar) writes that it was uploaded under Anthropic's verified account, calls it an Anthropic compromise, and says the version was removed without notice to customers. Those are his claims; we found no Anthropic statement in the sources we read, and the scale he gives ("tens of millions of developers") is not supported by Cursor's figure.

Why it matters: An agent's IDE extension runs with the user's permissions, and in this build the payload ran on load. Your harness inherits whatever trust the editor has, so check authorized_keys for svc-telemetry now, and rotate credentials if you find it.