A Tampered Claude Code Extension Appeared in Cursor's Marketplace: ~5,000 May Have Installed an SSH Backdoor
You downloaded an "official" plugin from an official marketplace, installed it on your dev machine — and it opened a door into your computer.
Three key facts
Cursor says in its official security notice that tampered versions of Anthropic.claude-code appeared in its VS Code Extension Marketplace: versions 2.1.312 and 2.1.313 on Windows and macOS. These versions were not developed by Anthropic. The exposure window ran roughly from 2:27 a.m. to 1:35 p.m. PT.
The malicious code's chain of behavior was fairly complete. It collected and reported host and user information (hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, public IP); attempted to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel; and tried to make the tunnel persistent via a macOS LaunchAgent or a Windows scheduled task (attempting to run as SYSTEM), with background scripts retrying the tunnel roughly every 60 seconds.
The key mitigating factor was permissions. Cursor notes that enabling the local SSH service requires admin rights, which the malicious extension lacks on most macOS and Windows hosts, so that step fails and the attacker could not log in through the tunnel. Due to errors in the malicious code itself, those steps would also have failed; the attacker's server has since been taken offline by its hosting provider. According to The Verge, Cursor says about 5,000 people may have installed it; the extension has been removed and Cursor verified that "no other extensions were tampered with."
Wang Dou's Take
Start with the most valuable piece of information here: it failed because "the malicious code had bugs" and "it didn't get admin rights." Neither is a designed defense — both are luck. In other words, if the attacker had written more careful code, or if some developer's Cursor happened to have been launched with admin privileges, the outcome would be entirely different. The safety of a security incident cannot rest on "the adversary made a mistake."
Second, that "about 5,000 people" number. In the world of AI coding tools, 5,000 developers is not a small figure — it could mean thousands of accounts with access to production environments, private repositories, and cloud credentials. A developer's machine was never "just a computer"; it's the keyring to the whole system. Supply chain attacks favor this target precisely because one picked lock opens many doors.
Third, the thing most worth remembering: this attack didn't exploit any vulnerability. It used the normal mechanism that "a plugin can install plugins." AI coding tools are becoming the central hub of developer workflows — they read your code, run your commands, connect to your repos — while their extension ecosystems still live in the era of "just click install." As you hand more authority to these tools, it's worth asking: who signed and verified the plugin I just installed?
Source: Cursor Security Notice · The Verge