Claude Code Extension: The Update Was the Backdoor

Between 09:27 and 20:35 UTC on Oct 29, 2026, Cursor's own extension store offered Claude Code 2.1.312 and 2.1.313 for macOS and Windows. Both carried Anthropic's genuine publisher ID. Cursor says at most 5,000 users got them and that Anthropic did not develop them.

The bundle was the real extension with a 66-line loader added in front of it. The loader ran when the extension loaded, which happens every time Cursor starts. No Claude chat was needed.

How the attacker got publish access to Cursor's store has not been disclosed. Cursor pulled both versions, shut down and rebuilt the store, rotated its keys and worked with the hosting provider to take the attacker's server offline.

Per Phorion and Microsoft, it appended an attacker key labelled svc-telemetry to ~/.ssh/authorized_keys and tried to switch on the local SSH service. It installed a startup item, a LaunchAgent called com.apple.sysmond on macOS or a SysMon scheduled task on Windows, that retried a reverse SSH tunnel about every 60 seconds.

Microsoft found Linux code as well: a user crontab `@reboot` entry. Cursor says its store served macOS and Windows builds, so treat any Linux machine with the extension as worth a check. On Windows, a batch file in the Startup folder is the fallback if the scheduled task fails.

It downloads nothing else. It uses autossh where present, silences every error and leaves the extension working, so the user sees nothing wrong. The tunnel points back at the laptop's own SSH port, so the attacker connects in through a connection the laptop opened.

It also sent the hostname, username, OS, home and working directories, Git email, public IP and the names (not the values) of up to 40 environment variables that look like keys, tokens or cloud credentials to the attacker's server on port 8099.

The saving grace: enabling SSH needs admin rights, and coding errors meant that step failed on most Macs and Windows machines. The key, the startup item and the report still landed, so every affected machine needs cleaning.

More access. A coding agent reads your files, runs your terminal and uses your credentials. Anything hiding inside it gets the same reach.

More ways in. Each agent brings extensions, plugins, MCP servers and SKILLs, each updating from a store you do not control.

Less scrutiny. Teams approve the tool once. Every update after that installs on its own. Approve an agent once, and you have approved every update it takes.

Oct 29, 09:27: tampered 2.1.312 and 2.1.313 go live in Cursor's store. 20:27: Daylight sees the tunnel start on a customer's Mac. 20:35: Cursor pulls both versions. Oct 30: OpenSourceMalware lists it (2.1.313 only). Oct 30, 07:59: ThreatFox lists the attacker's server. Oct 31, 02:00: still no entry in OSV.

The bad builds used the same name and version numbers as the real releases. Only the bytes changed. A feed that matches on name and version cannot flag the bad copy without flagging the clean one, and Cursor's store is not one of the registries OSV tracks.

What caught it first was behaviour on real laptops, seen by Phorion, Daylight and Coralogix. A code editor extension had no reason to add a login key, create a startup item or open a tunnel to an unknown server.

Not a compromise of Anthropic's systems, per Anthropic's Felix Rieseberg and Microsoft. Not served by Open VSX, the Microsoft VS Code Marketplace or the @anthropic-ai/claude-code npm package; an early report naming Open VSX was corrected, as Socket documents. We found no link to the Mar 2026 Claude Code source leak.

Socket's records show why the Open VSX claim did not hold. Open VSX keeps a permanent change log. From Oct 27 it lists all eight builds of 2.1.312 and 2.1.314, and nothing for 2.1.313. In the same window it kept both the publish and removal events for 42 other pulled versions, one gone after about 90 seconds. npm's publish history also jumps from 2.1.312 to 2.1.314, and so do Anthropic's GitHub releases. A skipped number proves nothing on its own; other numbers are skipped too.

Socket also found that the download sizes in the first report's screenshot match 2.1.314 exactly. The lesson for responders: confirm the channel against the store owner's notice and the store's own records before acting on an early report.