Cursor Claude Code extension backdoor Oct 29 2026 — Current Guide

Confirmed timeline and scope

Confirmed (official): Cursor published a security notice on Oct 29, 2026 describing that Anthropic.claude-code versions 2.1.312 and 2.1.313 were maliciously modified and distributed from its VS Code Extension Marketplace for about 11 hours [1].

Independent reporting: Security researchers and incident responders who examined affected machines reported the build delivered a persistent SSH backdoor and called the package trojanized. These analyses were published by StepSecurity and pwn.watch on Oct 30, 2026 and corroborate the behavior described by Cursor [2][3].

Estimated impact (confirmed by Cursor): Cursor estimated the tampered package may have reached up to ~5,000 users during the distribution window [1]. As of Nov 1, 2026, that count and scope remain the best public estimate; the exact number of compromised hosts is subject to ongoing investigation [1].

What the malware did (technical summary)

Independent analyses found the malicious builds altered the extension’s installation or post-install scripts to place an SSH key and a small daemon or system service on host machines. That artifact created an open, persistent access method over SSH so a remote operator could connect to affected machines without the owner’s credentials [2][3].

Confirmed elements:

• Malicious builds: Anthropic.claude-code 2.1.312 and 2.1.313 distributed via Cursor’s marketplace [1].
• Persistent access method: an SSH backdoor implanted on developer workstations, enabling remote shell access [2][3].
• Distribution window: approximately 11 hours on Oct 29, 2026 [1].

How attackers typically persist an SSH backdoor

While every trojan differs, common persistence techniques seen in this incident and similar supply-chain compromises include creating or appending to authorized_keys, installing a private key in a hidden directory, adding a system-level service or cron job to relaunch a small listener, and disguising files as legitimate extension assets. The independent reports noted patterns consistent with those techniques in affected builds [2][3].

Who should be worried right now

If you installed or updated the Anthropic.claude-code extension from Cursor’s VS Code Extension Marketplace during the affected window on Oct 29, 2026, consider your machine and any networks it connects to at elevated risk [1].

Priority groups:

• Developers and dev teams who run code or have SSH access to servers from their development workstations.
• CI/CD hosts, build agents, or shared dev machines that may have been used while the malicious extension was installed.
• Small businesses and contractors who store secrets, SSH keys, or credentials locally.

Immediate steps to contain and remediate (step-by-step)

Below are prioritized actions. These are practical, conservative steps for developers and IT teams. Labeling: the removal steps below are recommended mitigation actions based on independent reporting and common incident response practice; they do not replace an organization’s formal IR process.

1. Uninstall the extension immediately. Remove Anthropic.claude-code from VS Code and from any machines where it was installed during the affected window [1].
2. Isolate affected hosts. Disconnect suspected machines from networks to prevent outbound/inbound access, or place them on a segregated VLAN for investigation.
3. Detect and remove implanted SSH keys. Check user and system SSH authorized keys and known key locations (~/.ssh/authorized_keys, /root/.ssh/authorized_keys, hidden folders). Remove unfamiliar keys and any files with unusual permissions. Independent analysis found implanted keys and a persistent agent in affected systems [2][3].
4. Rotate credentials and keys. Immediately rotate SSH keys used from affected hosts, as well as API tokens and any credentials stored locally. Assume any credential accessible from an infected host may be compromised.
5. Collect forensic data. Save memory and disk snapshots, copy logs, and document installed files and services before making destructive changes. This helps incident response and attribution.
6. Check for new services, cron jobs, or scheduled tasks. Look for suspicious systemd units, init scripts, launchd plists (macOS), or cron entries that reintroduce a backdoor.
7. Scan and rebuild if needed. For any host that showed evidence of backdoor activity, consider rebuilding from known-good images or reinstalling the OS after preserving forensic artifacts. Rebuilding removes hidden persistence with the highest assurance.
8. Audit CI/CD pipelines and servers. Ensure build agents, deployment keys, and server-side access were not used or replaced by the attacker. Rotate keys and secrets used by CI systems.
9. Notify stakeholders. Inform internal security teams, clients, and any parties that rely on compromised machines. Follow contractual and regulatory incident disclosure requirements where applicable.
10. Report findings to Cursor and Anthropic. Cursor has posted an official security notice; report new indicators you find to them and to Anthropic to assist containment [1].

Quick detection checklist (command-style hints)

• Look for unexpected SSH keys: inspect ~/.ssh and /root/.ssh for new files and authorized_keys entries.
• List recent package installs and extension directories: check VS Code’s extensions folder for modified timestamps during Oct 29, 2026.
• Search for persistent processes and system services added on or after Oct 29, 2026.
• Review outbound connections and unknown listening ports created by user processes.

Risk assessment and likely impacts

Confirmed: The injected SSH backdoor creates a high-impact confidentiality and integrity risk for affected machines because remote operators could access code, secrets, and networked systems from the developer endpoint [2][3].

Estimated typical consequences (analysis and estimates): Remote access from a compromised developer workstation can lead to credential theft, source-code exfiltration, unauthorized deployments, and lateral movement to production or staging servers. The actual damage depends on whether the attacker exploited access to reach other high-value targets. As of Nov 1, 2026, public reporting does not document large-scale downstream breaches tied to this supply-chain incident [1][2][3].

What to change in your security posture

Supply-chain compromises like this highlight several controls that materially reduce risk over time:

• Use least-privilege SSH keys and avoid reusing keys across machines and services.
• Keep secrets out of local developer workstations; prefer ephemeral credentials, secret managers, and short-lived tokens.
• Harden developer endpoints: EDR (endpoint detection and response), managed updates, and host-based auditing can speed detection.
• Use code signing and verified extension repositories where possible. Verify checksums and release provenance for critical tools.

Quick comparison: actions by priority and timeframe

Confirmed and independent sources

Official disclosure: Cursor’s security notice confirming the malicious builds and the distribution window is the primary, confirmed source for the incident timeline and scope [1].

Independent analysis: StepSecurity and pwn.watch published technical write-ups and detection findings that corroborate the presence of a persistent SSH backdoor in the tampered extension builds [2][3].

Note: As of Nov 1, 2026 these sources represent the verified public record. Ongoing investigations by Cursor and other responders may add new indicators.

Practical next steps for small dev teams and contractors

1. Determine which team members installed or updated anthopic.claude-code on Oct 29, 2026.
2. Follow the containment checklist above for each suspected host.
3. Prioritize servers and CI systems with credentials that were accessible from compromised hosts.
4. Engage an incident response partner if you lack forensic expertise or if the incident scope is high.
5. Document all actions and communications for compliance and insurance purposes.

FAQs

Closing summary and final advice

Confirmed details show that a tampered Anthropic.claude-code build distributed via the Cursor VS Code Extension Marketplace on Oct 29, 2026 installed an SSH backdoor on some developer machines and may have affected up to ~5,000 users [1][2][3]. If you installed or updated the extension during the reported window, treat hosts as potentially compromised, isolate them, and follow the containment, detection, and recovery steps above.

For small teams, the practical approach is immediate containment, rotating credentials, and rebuilding any host with confirmed indicators of compromise. For larger organizations, coordinate with incident response and legal teams while documenting actions and communications. Finally, learn from the incident: reduce local secrets exposure, enforce least privilege, and strengthen extension and package verification into your developer workflow.