Malicious Claude Code Extension on Cursor Tried to Plant SSH Keys

Tampered builds of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, sat on Cursor's VS Code Extension Marketplace for about 11 hours on October 29 and tried to plant an attacker's SSH key on machines that loaded them. Uninstalling the malicious Claude Code extension may not remove that key or its persistence, so Cyprus firms with Cursor users should treat affected laptops as an assumed breach until checked.

Who was exposed to the malicious Claude Code extension?

Only developers who installed or auto-updated Claude Code through Cursor’s VS Code Extension Marketplace on October 29. Cursor’s security notice puts the window at about 2:27am to 1:35pm Pacific time, about 11:27 to 22:35 in Cyprus.

The tampered releases, 2.1.312 and 2.1.313, shipped for Windows and macOS. Cursor removed both and stated they “were not developed by Anthropic.”

Felix Rieseberg of Anthropic’s technical staff said on X that Anthropic’s systems and employee laptops were not compromised. A malicious actor used access to Cursor’s marketplace to publish the modified extension. “The versions on our official channels are not affected, and this only impacts Cursor users,” he wrote.

How the attacker obtained publishing access, how many machines installed the builds, and who operates them are still unpublished.

Does a failed SSH setup mean the laptop is safe?

No. Phorion found the injected code at the start of the extension’s JavaScript file, so it ran when the extension loaded, ahead of normal activation. “The user doesn’t need to interact with the extension for the payload to fire,” Phorion said.

The payload tried to append an attacker-controlled public key to the user’s authorized_keys file, enable the local SSH service, open a reverse tunnel to an attacker-controlled server, drop scripts and startup entries outside the extension folder so the connection could return after a reboot, and collect host details and send them to the attacker.

The attacker’s code had bugs. On macOS, a Remote Login check needs administrator rights. Without them the command returned an access error and the malware skipped enabling SSH. On Windows, Phorion found an error that could stop the SSH service setup command. Cursor says enabling the local SSH service generally fails without administrator rights, while key injection, persistence and sending host information could still succeed.

This is our reading, not the vendors’: the extension runs as the signed-in user, who can edit authorized_keys without an administrator prompt. An outbound reverse tunnel is not stopped by NAT or by blocking inbound port 22, and it need not use port 22.

Microsoft Threat Intelligence says the code collected machine names, usernames, operating systems, working directories and Git email addresses, plus up to forty environment-variable names containing KEY, TOKEN, SECRET, PASS, AWS or GCP. It stored the names, not the values.

Published analyses include no file hash, no attacker public key and no server address. Phorion’s marker is the comment svc-telemetry, which should not be trusted on its own.

Is uninstalling Claude Code enough to clean the machine?

No. Cursor warned that uninstalling alone might not remove the components, because the malware placed them outside the extension’s installation directory.

For any machine that pulled 2.1.312 or 2.1.313 through Cursor:

1. Inventory first. List Cursor users, Claude Code versions and update times inside the October 29 window.
2. Preserve before you clean. Export telemetry, copy suspicious scripts and keep timestamps. Isolate a host with an active tunnel or an unknown key login.
3. Check authorized_keys for every interactive account on the machine, not only the developer who uses Cursor.
4. Match by fingerprint, not the comment. Phorion says svc-telemetry is only a label. Use ssh-keygen -lf and treat any key with no known owner as hostile.
5. Review startup entries and scripts dated on or after October 29.
6. Check egress for long-lived outbound sessions from these hosts, on any port.
7. Go one hop out. Check authorized keys on hosts those developers can reach, review logs for unfamiliar keys, and rotate cloud and Git credentials that may have been exposed.

On the assumed breach assessment work we run, a developer laptop is usually the shortest route into production. The Git email and working directory the malware collected point an attacker at forwarded SSH sessions, cloud keys in shell profiles and repository push rights on that machine.

Why does an IDE marketplace count as a supplier under NIS2 and DORA?

It delivers executable code onto staff machines under their own accounts. Cursor handled this as a supplier incident: it pulled the versions, shut the marketplace temporarily, audited access, rotated keys and rebuilt the marketplace before restoring it.

Yash Kadakia, founder and CTO of Security Brigade, called an extension marketplace “effectively another software supply chain.” He argued for publisher verification, package integrity checks, an extension allowlist, controlled updates and limits on outbound connections from developer machines.

NIS2 Article 21 covers supply-chain security and security during acquisition, development and maintenance. DORA has applied to in-scope financial entities since January 17, 2025, and requires them to manage ICT third-party risk.

Cyprus supplier registers we see name cloud hosts and core platforms far more often than IDE marketplaces, AI coding agents or MCP servers. Those pull third-party code and run it with a shell. The same class of failure appeared in the LiteLLM supply chain attack, one step closer to the keyboard here. An AI supply chain security audit is how those items get onto the register, with a record of what each can reach.

How do you evidence this for CySEC, DORA or NIS2?

Open an incident file even when the checks find nothing. Installation by itself is not a reportable event under NIS2, DORA or GDPR; confirmed impact is. A statement that Anthropic’s own systems were clean does not answer how you reached “no impact.” Keep:

• who used Cursor, which Claude Code version, and when it was installed or updated;
• which files, startup items and reachable SSH servers were checked;
• which credentials were rotated and the reason;
• how you classified the event.

Once impact is confirmed, reporting clocks run. NIS2 significant incidents require a 24-hour early warning and a 72-hour notification to the Digital Security Authority and CSIRT-CY. DORA major ICT-related incidents go to CySEC or the Central Bank of Cyprus.

A Git email or a username can be personal data, yet a security incident is not automatically a GDPR breach notification. The controller assesses risk to people, then decides whether to notify the Commissioner for Personal Data Protection. That path is part of NIS2 and DORA readiness.

Ask whether your endpoint tooling can, within one working day, list every laptop that loaded Claude Code 2.1.312 or 2.1.313.

FAQ

Which Claude Code versions were malicious?

Versions 2.1.312 and 2.1.313, the Windows and macOS builds distributed through Cursor's VS Code Extension Marketplace on October 29.

Did Anthropic get breached in the Cursor incident?

Anthropic says no. Felix Rieseberg said its systems and employee laptops were not compromised, and that an actor with access to Cursor's marketplace published the modified build. Anthropic said it was working with Cursor.

Does uninstalling Claude Code remove the SSH key?

Not necessarily. Cursor says uninstalling might not remove components written outside the extension directory, including a planted key and startup entries.

If your developers run AI coding extensions, agents or MCP servers with shell access, our AI agent penetration testing shows what that tooling can reach and gives you evidence your regulator will accept.