Claude Code Extension Backdoored on Open VSX and Cursor

§ 01What Cursor confirmed#

Cursor’s notice is the first account from a company that actually distributed the build. It says plainly: “This malicious version of the extension was not developed by Anthropic.” It removed the version, then shut its whole extension marketplace down, audited it, rotated its keys, rebuilt it and brought it back. It also worked with the hosting provider to take the attacker’s server offline, and writes that “The attacker server no longer functions.”

What Cursor’s notice adds to the researchers’ report:

• Who built it: not Anthropic, Cursor says.
• Where: Cursor’s VS Code extension marketplace, as well as Open VSX.
• When: 2:27am to 1:35pm Pacific, October 29, 2026.
• How many: at most 5,000 users, whom Cursor will contact directly.
• Attacker server: taken offline with the hosting provider.

The SSH detail matters more than it looks. Because enabling the local SSH service needs administrator rights, Cursor says the step failed on most macOS and Windows machines, so the attacker could not log in through the tunnel. The extension still added the attacker’s key, installed its persistence and sent host details out, which is why Cursor asks every affected user to run its remediation anyway.

§ 02What the loader did#

The package looked normal. The bundled binary was the official one and the interface was unchanged. The only altered file was extension.js, where 66 lines of new code sat in front of the real extension and ran first, which means a user never had to start a Claude conversation for it to fire.

Two details make this worse than the usual package-manager attack. Errors are suppressed almost everywhere, so when a step fails the real extension keeps loading and nothing looks wrong. And the persistence names borrow from system monitoring, so a quick look at a process list or a LaunchAgents folder does not obviously show an intruder.

§ 03Where version 2.1.313 is now#

We checked the three places the extension ships from: the Open VSX version list, the VS Code Marketplace listing and the npm package. The malicious version is in none of them, and the clean follow-up went out across all three within about an hour.

A missing version number alone was never proof of a takedown, which is why we held back on it before Cursor spoke. Cursor’s notice now settles part of it: the 2.1.313 build in its marketplace was not Anthropic’s, and Cursor removed it. The Open VSX listing’s download counter is an all-time figure for the extension, not a count of people who got the bad build; Cursor’s 5,000 is the only reach figure anyone has given.

§ 04What is not established#

The researchers draw the line themselves. Their report says the findings “show that this specific artifact is malicious; they do not, by themselves, demonstrate that Anthropic’s official Marketplace release or distribution infrastructure was compromised.” They also say they do not know how the build got published, only that the Open VSX publishing account belongs to an Anthropic employee, and that the employee may or may not have been compromised.

Cursor’s notice answers some of that and leaves the rest open. Still unknown: how the build got published, whether Open VSX and Cursor received it through the same account, how many of Cursor’s at most 5,000 users actually ran it, and what Anthropic’s own investigation finds. Cursor says it has “no evidence that other versions of the extension or the official distribution are affected.” We have found no statement from Anthropic, Open VSX or the Eclipse Foundation.

§ 05If you installed it#

The report’s own advice is blunt: “Rebuilding the host is safer than assuming removal of known artifacts restores trust.” If you installed or updated the Claude Code extension in Cursor between 2:27am and 1:35pm Pacific on October 29, or pulled it from Open VSX in the last few days on VSCodium, Windsurf or another editor, check before you assume you are clean, and move to 2.1.314. Cursor adds that “Uninstalling the extension may not be sufficient” because the payload leaves its own scripts running.

Cursor’s one-line check on macOS is grep -qs svc-telemetry ~/.ssh/authorized_keys && echo found, and it publishes remediation scripts for macOS and Windows in the notice. Look for the SSH key comment svc-telemetry in ~/.ssh/authorized_keys, for ~/.config/.smt and ~/.config/.smtk, for a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS, a cron entry that runs at reboot on Linux, or a scheduled task named SysMon on Windows. On the network side, block and search for 134.209.82.225 on ports 22 and 8099. If any of it is present, treat the credentials that machine could reach as exposed and rotate them from a different computer.

§ 06Why this one matters beyond one extension#

The interesting part is not the malware, which is ordinary. It is the delivery. Coding agents arrive as editor extensions that people install in seconds and update silently, and those extensions run with the full rights of the developer who installed them: their SSH keys, their cloud credentials, their repositories. An agent extension is one of the highest-privilege things on a working machine, and it is distributed through the lowest-friction channel we have.

That is the same structural problem behind the LiteLLM package that shipped malware and behind agents breaking out of a sandbox at OpenAI. The answer is not to stop using agents. It is to stop giving them your own identity. An agent with its own account, its own machine and an explicit list of what it may reach is recoverable when something like this happens; an agent wearing your login is not.