An 11-hour wait would have stopped the Claude Code extension backdoor

11 November 2026 · Carl Heaton · Security AI

If your developers use Cursor or VS Code, their editors update their own extensions in the background. Nobody approves each new version. Most of the time that is exactly what you want, because updates carry fixes.

On 29 October it carried a backdoor. For about 11 hours, from 09:27 to 20:35 UK time, Cursor's extension marketplace served a tampered copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313. Anyone who installed it, or whose editor updated to it, ran the attacker's code the moment the editor loaded it. The Register reports that up to 5,000 developers were affected.

The useful lesson is not "be careful what you install". Nobody installed anything unusual. They used the official extension, from the official shop for their editor, and it changed underneath them.

What happened, and what is still disputed

Phorion, an endpoint security firm, found the backdoor. Cursor's security notice confirms the versions and the window, and says it pulled the extension, shut its marketplace down, rotated its own keys, and had the attacker's server taken offline.

Microsoft's analysis confirms the bad versions never appeared on Microsoft's own Visual Studio Marketplace or on npm. Some early commentary said Anthropic had been hacked. Anthropic denies it. One of its engineers said, as quoted by The Register, that "a malicious actor used access to Cursor's marketplace to publish a tampered copy". How that actor got access has not been explained. What is established is narrower and is enough to act on: Cursor users on macOS and Windows, on those two versions, in that window.

The payload did four things:

Added an attacker's key, labelled svc-telemetry, to the user's SSH authorized_keys file, the list of keys allowed to log in to that machine.
Tried to open a hidden connection out to the attacker's server, so they could log back in through it.
Set itself to restart after every reboot.
Sent the attacker the machine name, username, Git email, public IP address, and the names of environment variables that looked like secrets, such as anything containing KEY, TOKEN, or PASS.

Cursor says the remote login step needed administrator rights the extension usually did not have, so on most machines the attacker could not get in. The key, the restart mechanism, and the report still landed. Updating or removing the extension does not clean them up.

If anyone at your firm uses Cursor

Check every machine for the key. Cursor's notice gives a one-line check for macOS and Windows. It looks for svc-telemetry in the authorised keys file.
If it is there, treat the machine as compromised. Run Cursor's clean-up script, then decide whether to rebuild. Microsoft's post lists every file and startup entry to remove.
Rotate what that machine could reach. The attacker saw which secret names existed, not their values. But Cursor's advice is to rotate credentials and sessions from a clean machine anyway, because a working backdoor could have read them later.

Why an allow list would not have helped

The usual advice after an extension incident, including ours, is an allow list: approve a short list of extensions and block the rest. That is still right. It would not have stopped this one. The tampered copy carried Anthropic's real extension ID, so any rule allowing Claude Code would have allowed it.

Two controls would have stopped it.

A delay on new versions. Cursor has a marketplace install cooldown: a team admin sets a number of hours, and no machine installs or updates to a version until it has been public that long. It is off by default. Any setting above about 12 hours would have meant no machine took the bad versions, because they were gone by then. Malicious uploads tend to be found quickly. A day's wait costs you almost nothing.

Pinned versions for the tools that matter. VS Code's extension controls can allow a specific version of an extension, not just the extension, and admins can enforce that through device management. It is more work, so save it for the handful of extensions that sit next to your production keys.

Browser extensions are the other half

The same week, Socket researcher John Tuckner identified 319 Chrome extensions with 13.4 million installs over a decade that quietly routed users' searches through their operators' servers. They were sold through search ads as PDF converters, manual finders, and "safe search" tools, and most were unlisted in Google's store, so you would only find one by clicking the ad.

That is the opposite problem to Claude Code: a stranger's extension, installed by a colleague solving a small task. An allow list is exactly the right fix here. Chrome and Edge both let you block extensions by default and allow named ones, through the Chrome extension policies and Edge's equivalent. If your laptops are managed through Microsoft Intune or Google Admin, it is a policy change, not a project.

What to do this week

Ask your developers which editors they use and which marketplace each one pulls from. Cursor uses its own, not Microsoft's.
If you use Cursor as a team, set the install cooldown to 24 hours.
Check for the svc-telemetry key on any machine that ran Cursor on 29 October.
Put browsers on block-by-default, with a short list of approved extensions.
Give developer laptops the same care as an admin's machine. They can reach the code, the deployment pipeline, and often the keys. AI coding tools add to that reach.

How Steelwise can help

Working out which tools on your developers' machines update themselves, and putting sensible delays and allow lists around them without slowing anyone down, is the kind of review we do. Get in touch.