PolicyCortex
Request Access
Summary
  • A tampered extension update reached Cursor users for about 11 hours.
  • The code added an attacker key and set up persistence on the host.
  • Removing the extension alone does not remove the key or persistence.
  • Check hosts, remove the artifacts, and rotate exposed credentials.

What happened

On October 29, 2026, a tampered update reached Cursor users. The update carried the name Anthropic.claude-code. It appeared in the Cursor Visual Studio Code (VS Code) Extension Marketplace. Versions 2.1.312 and 2.1.313 for Windows and macOS were affected. The window ran from about 2:27am to 1:35pm Pacific Time. Cursor says the tampered build was not made by Anthropic. Anthropic says its own systems were not compromised. Cursor says no other extension showed signs of tampering. Cursor said at most 5,000 users were affected, in a post quoted by The Hacker News.

What the code did

The code ran when the extension loaded. It collected host details and sent them to an attacker server. The details included hostname, username, operating system, and public IP address. It added an attacker Secure Shell (SSH) key to authorized_keys. The key carried the label svc-telemetry. The label was meant to look harmless. It tried to turn on the local SSH service and open a reverse tunnel. On most hosts that step failed without admin rights. The key, the persistence, and the host report still happened. Persistence came through a macOS LaunchAgent or a Windows scheduled task. Background scripts retried the tunnel about every 60 seconds. Cursor worked with the hosting provider to take the server offline. The tunnel and the host report no longer reach that server. The attacker endpoint was 134.209.82.225, with a beacon on port 8099.

What to do

Check every host that installed or updated the extension in the window. Search authorized_keys for the svc-telemetry label. On macOS, check for the com.apple.sysmond LaunchAgent. On Windows, check for the SysMon scheduled task. Isolate any host that shows the key or persistence. Remove the key, the persistence, and any tunnel process. Removing the extension alone does not clean the host. Rotate credentials and sessions reachable from an affected host. Do that rotation from a trusted system, not the affected host. Consider a rebuild when cleaning in place leaves doubt.

The governance lesson

A trusted update channel carried the attack. The marketplace name looked right. The publisher name looked right. The version number looked normal. Nothing in the listing warned the user. That is why tool inventory matters. A team must know which developer tools run on each host. It must know the exact version on each host. It must keep proof of what it checked after an incident. A clean update after the incident is not proof of removal. Proof of removal is the key check, the persistence check, and the rotation record. PolicyCortex helps teams link that proof to requirements.

Sources

Next step

Check every developer host for the svc-telemetry key, then record the result.

Questions on this record
Which versions were tampered?
Anthropic.claude-code versions 2.1.312 and 2.1.313 in the Cursor marketplace.
Was Anthropic compromised?
No. Anthropic says its systems were not compromised. The tampered build came through Cursor's marketplace only.
Does removing the extension fix the host?
No. The key and persistence live outside the extension folder. Remove them separately.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. Fake AI Models on Hugging Face Turn GPUs Into MinersPluto Security found 31 fake model repositories on Hugging Face. Loading one with remote code enabled runs attacker code before the model loads.5 min
  2. CISA Adds the Brotli Decoder Flaw to Its Exploited ListA flaw in the Brotli decoder is now on the federal exploited list. Federal agencies must act by November 10, 2026.4 min
  3. Two Wasmtime Flaws Break the Sandbox PromiseTwo flaws score 9.9. Each lets a crafted module escape its sandbox. The fix is a version check, not a new tool.5 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere