Cursor says tampered Claude Code extension impacted about 5,000 systems
The point
Cursor says a tampered Claude Code extension 2.1.313 tried to install a persistent SSH backdoor and impacted around 5,000 developer systems. Anthropic says a malicious actor used Cursor marketplace access to publish it.
Why it matters
Builders who used that extension in Cursor should hunt for the backdoor, not just update.
Key details
- Code collected hostname, username, OS, architecture, home directory, Git email, and public IP
- It tried to add an attacker SSH key and open a reverse tunnel
- Version 2.1.314 replaced 2.1.313, but updating does not remove the backdoor from infected systems
Original ~4 min → 25 sec here Source: DoublePulsar, Oct 30, 2026