> ## Content Index
> Fetch the complete content index at: https://www.dailyferment.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# The backdoored Claude Code extension said Anthropic. Anthropic never shipped it.
- URL: https://www.dailyferment.com/claude-code-extension-cursor-backdoor/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-31T13:00:00.000Z
- Description: A tampered Claude Code extension reached Cursor users on 29 October. Anthropic never published it. A 1982 rule about medicine bottles says what should change.
- Author: Rana Bilal Zafar
- Tags: Engineering, #reframe

For about eleven hours on 29 October 2026, Cursor's extension marketplace served a tampered copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313 for macOS and Windows, that tried to plant an attacker's SSH key on developers' machines. Anthropic did not publish those builds. Open VSX, the registry Cursor draws on, has no record of 2.1.313 at all. The tampering happened inside Cursor's own marketplace, under Anthropic's name. "Was Anthropic hacked?" turns out to be the wrong question. The one I keep coming back to: when a store shows you a publisher's name, whose promise is that?

## What happened, in order

Cursor's security notice says that between about 2:27am and 1:35pm Pacific on 29 October, "a maliciously modified version of Anthropic's Claude Code extension was made available in the Cursor VS Code Extension Marketplace." On load, the code reported the machine's hostname, user name, Git email, public IP and the names of environment variables to an attacker's server. It added an SSH key labelled svc-telemetry, tried to turn on the SSH service and open a reverse tunnel, and set itself up to come back after a restart.

![Diagram of how the Claude Code extension reaches a Cursor user: Anthropic publishes to Open VSX, Cursor's marketplace proxy serves it to the editor, and the tampered 2.1.312 and 2.1.313 builds entered at Cursor's marketplace on 29 October 2026, with Open VSX holding no record of 2.1.313](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/10/df87-store-chain.png)

Card by Daily Ferment. Sources: Cursor security notice and docs; Socket, 30 Oct 2026.

Cursor says turning on SSH needs admin rights the extension usually did not have, so on most machines the attacker could not log in through the tunnel. The key, the persistence and the beacon still landed. Cursor pulled the version, took the whole marketplace offline, audited it, rotated its keys, rebuilt it and brought it back. It says "These malicious versions of the extension were not developed by Anthropic." Help Net Security reported Cursor's figure of at most 5,000 affected users.

How it unfolded (UTC)
1. **27 Oct, 18:36** Anthropic publishes the genuine 2.1.312 to npm (npm record, via Socket).
2. **29 Oct, about 09:27** Tampered builds labelled 2.1.312 and 2.1.313 appear in Cursor's marketplace (Cursor: 2:27am PT).
3. **29 Oct, about 20:35** Cursor removes them and takes the marketplace offline (1:35pm PT).
4. **30 Oct, 00:12** Anthropic publishes 2.1.314 to npm, skipping 2.1.313.
5. **30 Oct, morning** First advisories (Phorion, StepSecurity) place the bad build on Open VSX.
6. **30 Oct, 14:08 to 14:50** Anthropic staff on Hacker News: 2.1.313 was never published on Open VSX, npm or the VS Code marketplace.
7. **30 Oct** Socket finds no Open VSX record of 2.1.313; Cursor updates its notice (18:30 UTC).

Sources: Cursor security notice; Socket Research Team; Hacker News; Phorion; StepSecurity. All 29 to 30 Oct 2026.

## My first reaction was wrong

The first headlines on Hacker News on 30 October said Anthropic had been hacked. One post's title said so outright. Phorion's advisory, the first detailed write-up, described the bad build as sitting on Open VSX under Anthropic's listing. StepSecurity's timeline had it going live on Open VSX and reaching Cursor "via mirror sync". I read it the same way: a publisher account or a build pipeline at Anthropic had been taken over.

Then the records came in. Socket's research team went through 3,392 events in Open VSX's public change feed from 27 October to the morning of 30 October. Every platform build of 2.1.312 and 2.1.314 was there. There were "No events for 2.1.313." In the same window, 42 versions of 21 other extensions were published and pulled, and every one left both entries, including one removed about 90 seconds after it went up. npm's history for the package skips 2.1.313 too. The screenshot that started the Open VSX story showed download sizes that match the later 2.1.314 builds, and it has since been taken down.

Anthropic staff said the same on Hacker News. An engineer who signed as "Felix from Anthropic" wrote that "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish." A second employee, signing as "Dworken from Anthropic", added that 2.1.313 "was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts", and that Anthropic numbered its next update 2.1.314 to keep the two apart.

Guess first: in 3,392 Open VSX change-feed events from 27 to 30 October, how many mention version 2.1.313?

**None.** Every build of 2.1.312 and 2.1.314 is there, and 42 versions of 21 other extensions that were published and pulled all left a record (Socket, 30 Oct 2026).

So the bottle was genuine at the factory. Someone opened it on the shelf.

## The shelf, in 1982

![A brightly lit pharmacy with shelves of health products and medicines](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/10/df87-split.jpg)

Illustrative. Photo by [Cheung Yin](https://unsplash.com/photos/pharmacy-interior-with-stocked-product-shelves-lile4HrTcvQ?ref=dailyferment.com) on [Unsplash](https://unsplash.com/photos/pharmacy-interior-with-stocked-product-shelves-lile4HrTcvQ?ref=dailyferment.com)

That is close to the exact shape of the Tylenol murders. On 29 September 1982 the first of seven people in the Chicago area died after taking Extra-Strength Tylenol. The poison was not added at the plant. The account Pharmacy Times gives is that someone bought bottles, laced them and "returned the bottles to store shelves for purchase." More than 31 million bottles were recalled. Who did it is still unknown.

The useful part for software is what came next. On 5 November 1982 the US Food and Drug Administration issued a rule requiring most over-the-counter medicines to be packed "so that a breach of the package would provide visible evidence to consumers that tampering had occurred." It did not try to make every shelf safe. It gave the buyer a seal. In 1998 the agency even changed the word from "tamper-resistant" to "tamper-evident", because the point was never that a package could not be opened. The point was that you could tell.

The cross: tampering on the shelf

#### Tylenol, 1982

- *Name on the product:* Tylenol, a genuine brand
- *Where it was tampered:* after sale, bottles returned to store shelves (Pharmacy Times)
- *Harm:* seven deaths in the Chicago area
- *Immediate response:* more than 31 million bottles recalled
- *Lasting fix:* FDA rule, 5 Nov 1982: packaging must give visible evidence of tampering

#### Claude Code in Cursor, 2026

- *Name on the product:* Anthropic, a genuine publisher
- *Where it was tampered:* inside Cursor's marketplace, not at Anthropic or Open VSX (Cursor, Socket, Anthropic)
- *Harm:* attacker SSH key, persistence, host details sent; at most 5,000 users (reported)
- *Immediate response:* version pulled, marketplace taken offline and rebuilt
- *Available fix:* publisher signatures checked by the editor, offered to Cursor enterprise teams

Sources: Pharmacy Times, 2022; Federal Register, 4 Nov 1998; Cursor notice and docs; Socket; Help Net Security.

## What the seal looks like for an extension

An extension store is a shelf. Cursor's documentation says it uses Open VSX for third-party extensions but routes search and downloads "through its own marketplace proxy." The name next to the extension, Anthropic in this case, is shown by that proxy. It is the store vouching for the publisher. Nothing in the label proves the bytes came from the publisher.

The software version of a foil seal is a signature the publisher makes and your editor checks before it installs anything. Cursor's docs say "Enterprise teams can require valid Open VSX extension signatures before install," and call signature verification a "client-side install control". Read plainly, that is a seal you can switch on if you run a team plan, not one every buyer checks by default. I have not seen anyone state whether the tampered builds carried a valid signature. If the attacker could change files in the store but could not sign as the publisher, a client that insisted on the signature would have refused them. That is my inference, not a finding.

I made a similar point about Ledger devices: [Ledger's genuine check passed, and nobody checked who owned the shop](https://www.dailyferment.com/ledger-cryptobilis-implant-reseller-change-of-control/). A check on the product says nothing about the shelf it sat on. And isolating each tool helps less than people hope when the trouble arrives through a shared path, as with [Nvidia's sandboxes, where the breach went between them](https://www.dailyferment.com/nvidia-openshell-agent-sandbox-shared-resources/).

## The strongest case the other way

Anthropic's position is that this is a third-party marketplace it does not own, maintain or review. That is true. The best counter came from a commenter in the same thread: Cursor's listing is marked as made by Anthropic, so users assume only Anthropic can release a new version, and if that is not so, it is Anthropic's problem as much as Cursor's. I think both are right, and the 1982 rule is a way to stop arguing about it. The maker cannot police every shelf, and the shelf cannot be the proof. The seal moves the check to the person installing.

If you used Claude Code in Cursor on macOS or Windows on 29 October, Cursor's notice has the check: look for svc-telemetry in your SSH authorized keys file and run its remediation script. Uninstalling the extension is not enough.

How to check a machine that ran Claude Code in Cursor on 29 October

Cursor's notice covers Anthropic.claude-code 2.1.312 or 2.1.313 installed or updated from the Cursor marketplace on macOS or Windows between 2:27am and 1:35pm PT on 29 October 2026\. Look for the text svc-telemetry in your SSH authorized keys file (on a Mac, \~/.ssh/authorized\_keys). If it is there, the machine is affected. Cursor publishes remediation scripts for macOS and Windows and advises running them either way, rotating any credentials the machine could reach from a clean system, and considering a rebuild. Uninstalling the extension does not remove the persistence it set up.

Established

The window, the versions and what the code did (Cursor's notice); that Open VSX and npm have no record of 2.1.313 (Socket's registry check); that Anthropic says it never built or published it (its staff, on the record).

Inferred

That a signature check at install would have refused the tampered builds. It depends on whether the attacker could also sign as the publisher, which nobody has said.

Still a guess

How the attacker got access to Cursor's marketplace, and whether signature checks will become the default for everyone.

The claim, in one sentence

A publisher's name in an extension store is the store's promise, not the publisher's, until your editor checks a seal the store cannot forge.

What I still do not know is how someone got write access to a store that serves this many developers, and whether "Verified" badges and signature checks will be turned on for everyone or stay a setting for teams that already think about this.

**More on Daily Ferment:** [A contractor's gateway let attackers into a bank. A school swimming lesson shows whose breach it is.](https://www.dailyferment.com/bank-breach-third-party-gateway-non-delegable-duty/) and [Meta's Muse asked for permission and still gave away a home address](https://www.dailyferment.com/meta-muse-agent-marketplace-address-permission/)

## Sources

- [Cursor: Security notice, malicious version of Anthropic.claude-code (2.1.312 and 2.1.313), 29 Oct 2026, updated 30 Oct 2026](https://cursor.com/blog/claude-code-extension-security-notice?ref=dailyferment.com)
- [Socket Research Team: Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace, 30 Oct 2026](https://socket.dev/blog/claude-code-extension-compromise?ref=dailyferment.com)
- [Hacker News: comments by Anthropic staff, 30 Oct 2026](https://news.ycombinator.com/item?id=50304129&ref=dailyferment.com)
- [Phorion: Official Claude Code VS Code extension compromise, 30 Oct 2026](https://phorion.io/blog/offical-claude-code-vsx-compromise/?ref=dailyferment.com)
- [StepSecurity: Trojanized Claude Code extension delivered persistent SSH backdoor, 30 Oct 2026](https://www.stepsecurity.io/blog/claude-code-extension-trojanized?ref=dailyferment.com)
- [Help Net Security: Claude Code extension poisoned with persistent SSH backdoor, 30 Oct 2026](https://www.helpnetsecurity.com/2026/10/30/claude-code-extension-ssh-backdoor/?ref=dailyferment.com)
- [Cursor docs: Extensions](https://cursor.com/docs/configuration/extensions?ref=dailyferment.com)
- [Pharmacy Times: Changes in the law result from OTC drug product tampering, 20 May 2022](https://pharmacytimes.com/view/changes-in-the-law-result-from-otc-drug-product-tampering?ref=dailyferment.com)
- [Federal Register: Tamper-Evident Packaging Requirements for OTC Human Drug Products, 4 Nov 1998](https://www.govinfo.gov/content/pkg/FR-1998-11-04/html/98-29388.htm?ref=dailyferment.com)