Cursor Marketplace Breach Exposes 5,000 Claude Code Users

- Malicious Claude Code extension builds with SSH backdoors released on Cursor marketplace - Incident underscores rising supply chain threats targeting AI developer tools On October 29, 2026 (UTC), CoinDesk reported that Cursor had removed two compromised versions of the Claude Code VS Code extension (2.1.312 and 2.1.313) from its marketplace after researchers identified malicious code that exposed up to 5,000 users to credential theft and persistent SSH backdoors. The incident occurred exclusively on Cursor’s extension marketplace and therefore did not affect Anthropic, npm, Open VSX, or the official Visual Studio Code repositories. Further analysis found that the compromised builds included a 66-line loader placed at the start of the extension’s JavaScript file, and this loader executed before the legitimate extension code. The injected code harvested host and credential information and generated an attacker-controlled “svc-telemetry” SSH key, then initiated a reverse SSH tunnel to a remote address (134.209.82.225) and installed persistent scripts via LaunchAgent on macOS and scheduled tasks on Windows. As a result, the malware persisted even after users uninstalled the extension. Cursor’s official notice advised affected users to delete the unauthorized SSH key and persistence scripts manually, then rotate credentials from uncompromised devices, while researchers confirmed that Anthropic’s systems and official marketplace versions remained unaffected. In addition, StepSecurity and the Cloud Security Alliance stated that this attack highlights a surge in supply chain threats against AI developer toolchains and echoes recent campaigns like GlassWorm and TrapDoor. Enterprises are responding with closer scrutiny of extension provenance, stricter marketplace policies, and new contractual security requirements, and surveys from Stack Overflow and GitHub show that these attacks continue to drive higher security standards and increase concern across the developer ecosystem.