{"id":"cursor-claude-code-backdoor-oct-2026","category":"supply-chain","status":"live","title":"Malicious Claude Code extensions in Cursor planted persistent backdoor components","tldr":"Malicious Claude Code extensions in Cursor potentially exposed up to 5,000 developers. Distribution has stopped, but affected computers need investigation and cleanup: updating or uninstalling the extension alone does not remove its backdoor components.","summary":"Cursor’s extension marketplace distributed malicious Claude Code builds 2.1.312 and 2.1.313 for macOS and Windows on 29 October. BleepingComputer reported potential exposure of up to 5,000 developers; this is not a confirmed infection count. The malware added an attacker’s remote-login key, installed components that could restart automatically and sent computer and user details. Coding errors and missing administrator permissions prevented remote access on many systems, but did not prevent all malicious activity. Microsoft found that the initial reporting sent environment-variable names rather than their secret values. Cursor removed the packages, rebuilt its marketplace and said the attacker server was taken offline. Expel nevertheless recorded outgoing tunnel activity on 30 October; the takedown’s exact timing is unknown. As at 3 November, affected computers still require cleanup and investigation. This is malicious software rather than a flaw resolved by a routine update, and the reviewed sources do not establish how many devices attackers successfully accessed.","action":"If anyone in your family uses Cursor with Claude Code, ask their IT team to check for the malicious marketplace builds, including automatic updates. If affected, disconnect the computer and follow Cursor’s macOS or Windows cleanup guidance, remove the unauthorised remote-access components, and rotate accessible credentials and sessions from a trusted device. Updating or uninstalling the extension alone is insufficient.","product":"Claude Code extension in Cursor’s extension marketplace","audience":"work","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["cursor","claude-code","malicious-extension","supply-chain","backdoor","macos","windows"],"affected":["Malicious Anthropic.claude-code 2.1.312 and 2.1.313 builds distributed by Cursor’s marketplace for macOS and Windows on 29 October 2026, approximately 02:27–13:35 Pacific Daylight Time"],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace","url":"https://cursor.com/blog/claude-code-extension-security-notice","by":"Cursor","date":"2026-10-30"},{"kind":"research","title":"Inside a malicious Claude Code-branded extension and its persistent SSH backdoor","url":"https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/","by":"Microsoft","date":"2026-10-30"},{"kind":"news","title":"Malicious Claude Code extension on Cursor planted SSH backdoors","url":"https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/","by":"BleepingComputer","date":"2026-10-30"},{"kind":"research","title":"Fake Claude Code extensions in Cursor: Malicious activity after the exposure window","url":"https://expel.com/blog/blog-fake-claude-code-extension-cursor-ssh-backdoor/","by":"Expel","date":"2026-10-30"}],"started":"2026-10-29","closed":null,"created":"2026-11-03T21:58:40.285Z","updated":"2026-11-03T21:58:40.285Z","cve_notes":[],"timeline":[{"at":"2026-10-30T18:30Z","added":"2026-11-03T21:54:09.841Z","kind":"vendor-revised","text":"Cursor revised its notice to include malicious version 2.1.312 alongside 2.1.313 and corrected its indicators of compromise.","url":"https://expel.com/blog/blog-fake-claude-code-extension-cursor-ssh-backdoor/","by":"Expel","patch":null},{"at":"2026-10-30T04:45Z","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"One customer Mac first showed malicious activity about eight hours after distribution ended. Expel observed its tunnel connecting out until 14:29 UTC, but did not observe attacker logins.","url":"https://expel.com/blog/blog-fake-claude-code-extension-cursor-ssh-backdoor/","by":"Expel","patch":null},{"at":"2026-10-30","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"Microsoft confirmed that its Visual Studio Marketplace and the npm Claude Code package were unaffected. It said Anthropic had confirmed its own systems were not compromised.","url":"https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/","by":"Microsoft","patch":null},{"at":"2026-10-29T20:35Z","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"Cursor stopped distributing the malicious builds after approximately 11 hours.","url":"https://expel.com/blog/blog-fake-claude-code-extension-cursor-ssh-backdoor/","by":"Expel","patch":null},{"at":"2026-10-29T09:27Z","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"Cursor’s marketplace began distributing malicious Claude Code extension builds 2.1.312 and 2.1.313 for macOS and Windows.","url":"https://cursor.com/blog/claude-code-extension-security-notice","by":"Cursor","patch":"na"},{"at":"2026-10-29","added":"2026-11-03T21:54:09.841Z","kind":"disclosed","text":"Cursor disclosed the incident. It said it had rotated keys, rebuilt and reopened its marketplace, and arranged the attacker server’s takedown; the takedown time was not specified.","url":"https://cursor.com/blog/claude-code-extension-security-notice","by":"Cursor","patch":null}],"url":"https://hard.fyi/live/cursor-claude-code-backdoor-oct-2026/","json":"https://hard.fyi/api/live?id=cursor-claude-code-backdoor-oct-2026"}