Cursor: malicious Claude Code extensions attempt persistent SSH access
Cursor: malicious Claude Code extensions attempt persistent SSH access
Claude Code extension versions 2.1.312 and 2.1.313 distributed through Cursor on Windows and macOS contain an SSH backdoor payload. Check installation and execution records; removal alone does not clear persistence.
Who should check: Teams running Cursor on Windows or macOS that installed or automatically updated the affected extension.
Preserve extension and endpoint evidence, investigate SSH persistence and isolate hosts with execution indicators; assess reachable credentials.
What happened and why does it matter?
Cursor identifies Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS as malicious. They were available through its marketplace on October 29, approximately 09:27–20:35 UTC. Microsoft reports that these packages were not distributed through Visual Studio Marketplace or the official Claude Code npm distribution. Anthropic did not develop the malicious packages.
Microsoft found injected JavaScript that runs when the extension module loads. It attempts to append an attacker-controlled SSH key, enable SSH, create reverse forwarding and establish startup persistence. Host-detail collection includes environment-variable names, not their values. Successful remote access depends on privileges and configuration; keys or persistence can remain even when the tunnel fails.
Cursor removed the packages and reports the attacker server offline. Those actions do not remove artifacts already written to endpoints. Investigate the affected installation before declaring recovery.
Oktsec recommends correlating installation, process, authentication and network evidence. Preserve records before cleanup, assess credentials reachable from affected processes and document the decision to remediate or rebuild. Do not infer a clean host from a single missing indicator.
- Vendor / publisher
- Cursor
- Disclosed
- Oct 29, 2026
- Latest evidence check
- Oct 31, 2026 UTC
Which systems and versions are affected?
| Product | Affected | Fixed release / action |
|---|---|---|
| Anthropic.claude-code from Cursor Marketplace (Windows/macOS) | Exactly 2.1.312 and 2.1.313; available October 29, approximately 09:27–20:35 UTC | Malicious packages removed. No replacement version is established by these sources; host remediation is required where affected. |
Use the guidance for your product and release branch. Confirm distribution backports with the vendor; the product name alone does not establish exposure.
What evidence supports this advisory?
Incident evidence
Priority rationale
Cursor confirms two malicious packages; Microsoft describes attempted SSH persistence. Act now for affected installations, while distinguishing payload execution from successful remote access.
What does this mean for AI environments?
Developer and agent workstations may hold repository tokens, cloud sessions and signing keys. Inventory what the affected process could access before restoring these workflows.
Sources behind this advisory
- Cursor security notice: malicious Anthropic.claude-code versionsCursor · Checked Oct 31, 2026 UTC
- Microsoft analysis: persistent SSH backdoor in the Cursor extensionMicrosoft Security Research · Checked Oct 31, 2026 UTC
Editorial record1 entry
Added the two malicious Cursor Marketplace extension versions, distribution window and host investigation steps; kept remote-access success conditional.
Plan your response
Use this checklist to decide whether the advisory affects your systems, record what your team does and share the result. Radar does not scan or verify your environment.
Changes save automatically in this browser. They are not synced with your team or sent to Oktsec.
1. Check whether this applies
Check affected systems and versions, then record your decision below. If you are unsure, choose “Needs verification”.
2. Track the response
Name the system and person or team handling the work. Update each action as you go; add a ticket reference or notes to explain what was checked.
Find affected installations and automatic updates
Preserve extension IDs, versions, package files and installation timestamps. Correlate the affected versions and marketplace with endpoint execution records; do not run a suspect package to test it.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.Investigate SSH access and persistence
Review authorized_keys, SSH service changes, outbound tunnels, macOS LaunchAgents and Windows scheduled tasks or Startup scripts. Isolate hosts showing payload execution or backdoor artifacts. Absence of one indicator does not establish a clean host.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.Assess credentials accessible from affected hosts
Inventory repository tokens, cloud sessions and signing material available to the process. Investigate their use; revoke sessions and rotate exposed credentials from a trusted system. Environment-variable names in the beacon do not rule out later credential access.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.Verify cleanup before restoring workflows
Remove confirmed keys, persistence and tunnel processes; determine whether rebuilding is required. Neither uninstalling the extension nor an offline attacker server proves the host is clean. Recheck authorized access before reuse.
Add evidence or notes
Use references only. Do not store credentials or confidential data here.
3. Share the plan
Download a Markdown file with your decision, action status, notes and source links. Share it with your team or attach it to a ticket.
Affected systems & fixes
Compare the running version and configuration with the vendor guidance.
| Product | Affected | Fixed release / action |
|---|---|---|
| Anthropic.claude-code from Cursor Marketplace (Windows/macOS) | Exactly 2.1.312 and 2.1.313; available October 29, approximately 09:27–20:35 UTC | Malicious packages removed. No replacement version is established by these sources; host remediation is required where affected. |
Confirm distribution backports with the vendor. A matching product alone does not establish exposure.
Evidence & sources
Why this priority
Cursor confirms two malicious packages; Microsoft describes attempted SSH persistence. Act now for affected installations, while distinguishing payload execution from successful remote access.
Prioritization criteriaSources
Technical facts come from these sources. Response priorities and recommended actions are Oktsec’s analysis.
- Cursor security notice: malicious Anthropic.claude-code versionsCursor · Vendor notice · Checked Oct 31, 2026 UTC
- Microsoft analysis: persistent SSH backdoor in the Cursor extensionMicrosoft Security Research · Research report · Checked Oct 31, 2026 UTC
Technical recordProducts, identifiers and supporting details
| Product / service | Anthropic.claude-code extension in Cursor MarketplaceCursor |
|---|---|
| Evidence | Attack attempts observed |
| Exposure | Affected package must execute |
| Fix / response | No fix availableAffected versions and fixes |
- Disclosed
- Oct 29, 2026
- Record reviewed
- Oct 31, 2026 UTC
For AI agent environments
Developer and agent workstations may hold repository tokens, cloud sessions and signing keys. Inventory what the affected process could access before restoring these workflows.