A tampered update to Anthropic’s Claude Code extension was served to developers through the Cursor extension marketplace for close to 11 hours on 29 October 2026, in a supply-chain attack that attempted to plant a persistent SSH backdoor on their machines. Cursor, the AI-powered code editor built on Microsoft’s open-source Visual Studio Code, says at most 5,000 users installed the malicious package before it was pulled.

The incident is a sharp reminder for enterprise technology leaders, including the large engineering teams at Indian IT services firms and global capability centres that have embraced AI coding assistants, that the tools developers now trust to write code have become an attractive route into the software supply chain.

What happened

According to Cursor’s security notice, versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension for Windows and macOS were available in its marketplace between about 2:27 am and 1:35 pm Pacific Time on 29 October. The packages carried Anthropic’s legitimate extension identity, so developers with auto-update switched on could have received them without taking any action.

Anthropic said the malicious versions were not built by the company and that its own systems were not compromised. Microsoft confirmed the tampered packages were never published on its Visual Studio Marketplace or through the npm @anthropic-ai/claude-code package, and security firm Socket found no evidence they reached the Open VSX registry. All evidence so far points to the incident being limited to Cursor’s marketplace. How the attacker was able to publish under Anthropic’s name there has not yet been explained publicly.

How the backdoor worked

Researchers at Phorion and OpenSourceMalware found that a short JavaScript loader had been inserted at the top of the extension’s main file, ahead of the otherwise unchanged legitimate code, so the assistant kept working normally. Microsoft Threat Intelligence, which published a detailed analysis on 30 October, said the loader runs as soon as the extension loads and attempts to:

• collect host details such as username, hostname, operating system, public IP address, Git email and the names of environment variables that look like keys, tokens or cloud credentials;
• add an attacker-controlled SSH key, labelled “svc-telemetry”, to the user’s authorised keys;
• switch on the local SSH service and open a reverse SSH tunnel to an attacker server;
• persist through a LaunchAgent on macOS, a cron entry on Linux, or a scheduled task and Startup-folder script on Windows.

Coding errors limited the damage. Enabling SSH needs administrator rights that the extension did not have on most Mac and Windows machines, and researchers found mistakes in the setup routines on both platforms, so on many hosts the tunnel could not have given the attacker a way in. Even so, the key, the persistence scripts and the reconnaissance beacon could still have been written or sent, which is why responders are being told not to rely on uninstalling the extension alone.

Response and remediation

Cursor said it removed the malicious versions as soon as they were detected, shut down the entire marketplace as a precaution, audited access, confirmed no other extensions had been tampered with, rotated its keys and rebuilt the marketplace before bringing it back. It also worked with the hosting provider to take the attacker’s server offline and has said it will contact affected users directly.

Organisations whose developers installed or auto-updated to the affected versions from Cursor during the window are advised to check for the “svc-telemetry” key, isolate any affected machine, preserve evidence, remove the unauthorised key and persistence artefacts, and rotate credentials and sessions reachable from that machine from a trusted system. Cursor has published check and clean-up scripts, and Microsoft has released hunting queries for Defender customers.

Why it matters for enterprise AI

AI coding assistants now sit inside developer environments with broad access to source code, cloud credentials and build pipelines, and they update frequently and often automatically. That combination makes their distribution channels a high-value target. Microsoft recommends that organisations using Cursor restrict extensions to approved publishers and set an installation cooldown so newly published versions are not adopted instantly.

For CIOs and CISOs, the lesson goes beyond a single editor. As agentic and AI-assisted development scales across Indian enterprises and GCCs, extension allow-lists, delayed updates, endpoint monitoring of developer machines and tight handling of secrets need to become standard parts of AI governance, rather than an afterthought once a tool is already in wide use.

Be a part of Elets Collaborative Initiatives. Join Us for Upcoming Events and explore business opportunities. Like us on Facebook , connect with us on LinkedIn and follow us on Twitter.

"Exciting news! Elets technomedia is now on WhatsApp Channels Subscribe today by clicking the link and stay updated with the latest insights!" Click here!