The Claude Code update Anthropic never shipped

For about 11 hours, Cursor's extension store served a tampered Claude Code build that planted an SSH backdoor. Whose build it was, and what to check now.

MATT Research11 min read
Illustration: The Claude Code update Anthropic never shipped

For about 11 hours on 29 October 2026, Cursor's extension marketplace served a tampered copy of the Claude Code extension that planted an SSH backdoor on developers' machines; Cursor says at most 5,000 users were affected. The build carried Anthropic's name, and it was never Anthropic's: Cursor says Anthropic did not develop it, and Anthropic and StepSecurity say it existed only in Cursor's marketplace. The official releases on Open VSX, Microsoft's Visual Studio Marketplace and npm were unaffected.

The way in was the extension store inside an AI coding tool, under a trusted name, onto developers' own machines, the place where several of this year's largest thefts began.

The 30‑second version

  • →What happened: from about 09:27 to 20:35 UTC on 29 October, Cursor's marketplace served tampered builds of Claude Code for VS Code, versions 2.1.312 and 2.1.313, for macOS and Windows. Cursor says at most 5,000 users were affected.
  • →What it did: on load, it added an attacker's SSH key, opened a reverse SSH tunnel, set itself to restart after a reboot and reported the machine's details, according to Phorion.
  • →How far it got: switching on the SSH service needs admin rights, so on most machines the attacker could not log in through the tunnel, Cursor says. The key, the start-up entries and the report still landed.
  • →Whose build: an early account said Anthropic had been hacked. Anthropic says its systems were not compromised, and the evidence since places the build in Cursor's marketplace only.
  • →Still open: how the attacker got access to Cursor's marketplace. Cursor has not said, and no one has been named.
  • →If you use Cursor: look for an SSH key labelled svc-telemetry. Updating or uninstalling the extension leaves the backdoor in place.
Timeline of 27 to 30 October 2026, times in UTC. 27 October, 20:27: Anthropic's clean version 2.1.312 is published on Open VSX; the tampered build later reused the number. 29 October, 09:27: Cursor's marketplace serves a tampered build, Claude Code 2.1.312 and 2.1.313 for macOS and Windows, listed under Anthropic's name, available for about 11 hours. 29 October, 20:35: Cursor removes it, then shuts the marketplace, audits access, rotates keys and rebuilds it. 30 October, 00:12 to 01:16: Anthropic publishes 2.1.314 on npm, Open VSX and Microsoft's marketplace, numbered past 2.1.313 to avoid confusion. By 07:09: Phorion's advisory. 07:46: Cursor says at most 5,000 users. 10:08: a widely shared blog post headlined Anthropic hacked, later updated with Anthropic's statement that the breach was at Cursor. 14:08 to 15:18: Anthropic staff say official channels were unaffected and 2.1.313 was never published. Microsoft and StepSecurity publish analyses: never on Microsoft's marketplace, and Cursor's 2.1.312 differs from the clean one. 18:30: Cursor updates its notice to name 2.1.312 as well as 2.1.313.
Sources: Cursor; Open VSX, Visual Studio Marketplace and npm records; Phorion; Microsoft; StepSecurity; Anthropic staff; DoublePulsar.

Eleven hours on 29 October

Anthropic published a clean version 2.1.312 to the Open VSX registry ↗ at 20:27 UTC on 27 October, the registry's records show. From about 09:27 UTC on 29 October, a tampered build was available in Cursor's marketplace. Cursor's notice ↗, updated on 30 October, names versions 2.1.312 and 2.1.313 for macOS and Windows. StepSecurity ↗ found that Cursor's 2.1.312 is a different file from the clean one on Open VSX, despite the shared number.

Cursor removed the build at about 20:35 UTC, then shut its marketplace down. It says it found no other extension tampered with, rotated its keys, rebuilt the marketplace, and had the attacker's server taken offline by its hosting provider. In a post on X ↗ early on 30 October it put the exposure at "at most 5,000 users" and asked all customers to update to version 2.1.314. Cursor has not said how the attacker got access to its marketplace, or who the attacker was.

Anthropic published 2.1.314 between 00:12 and 01:16 UTC on 30 October on npm, Open VSX and Microsoft's marketplace. No registry holds a 2.1.313. David Dworken of Anthropic said on Hacker News ↗ that 2.1.313 was never published on Anthropic's channels, and that Anthropic numbered its next update 2.1.314 to keep the two apart.

What the backdoor did

The most detailed analysis comes from Calum Hall at Phorion ↗, an endpoint security company. The malicious code sits at the top of the extension's main file, extension.js, and runs as soon as the editor loads it, before the extension's own code; nobody has to open Claude Code. In order, it:

  • →Plants a key: it appends an attacker's public SSH key, labelled svc-telemetry, to the user's authorized_keys file, the list of keys allowed to log in to the machine.
  • →Tries to switch on SSH: that needs admin rights, which the extension lacks on most macOS and Windows machines, Cursor says. Phorion found that on macOS the check misreads the permission error and skips the step.
  • →Opens a reverse tunnel: an outbound SSH connection to the attacker's server at 134.209.82.225 lets the server reach back to the machine's own SSH port, retried every 60 seconds.
  • →Survives a reboot: a LaunchAgent named com.apple.sysmond on macOS, a scheduled task named SysMon or a Startup-folder script on Windows, and a cron entry on Linux.
  • →Reports in once: the hostname, user name, operating system, Git email, public IP and the names of up to 40 environment variables that look like keys, tokens or secrets. The values stayed behind; the names show which machines hold credentials.

The code has no other command channel: the operator would log in through the tunnel with the planted key, which works only where SSH is running. Phorion also found bugs, including a Windows setup that calls a Unix shell, and a Linux cron step that can wipe existing scheduled jobs.

Microsoft's analysis ↗ cautions that a running SSH process alone does not show anyone logged in. Cursor adds that the limited collection "does not rule out later credential access over the backdoor".

The tampered Claude Code build, step by step: six steps when the file loaded, one of which usually failed. Step 1, runs on load: code added to the top of extension.js runs when the editor loads the file, before the extension starts, with no click needed. Step 2, plants a key: appends an attacker's SSH key labelled svc-telemetry to ~/.ssh/authorized_keys. Step 3, tries to switch on SSH, which usually failed: it needs admin rights, so on most macOS and Windows machines this step fails, Cursor says, and without it the attacker cannot log in through the tunnel. Step 4, opens a reverse tunnel: an outbound SSH connection to the attacker's server that leads back to the machine's port 22, retried every 60 seconds and kept running after the editor closes. Step 5, survives a reboot: a LaunchAgent named com.apple.sysmond on macOS, a task named SysMon or a Startup script on Windows, a cron entry on Linux. Step 6, reports in once: hostname, user name, OS, Git email, public IP and the names, without values, of up to 40 environment variables. Notes: if SSH was already on, or is turned on later, the planted key works through the tunnel; the code holds no secret values and no custom command channel; updating or uninstalling the extension leaves the key, the scripts and the start-up entry in place.
Sources: Phorion; Cursor; Microsoft; StepSecurity.

Whose build was it

The first widely shared account came early on 30 October from the security researcher Kevin Beaumont, on Mastodon ↗ and in a blog post ↗ headlined "Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide". He wrote that the extension updates itself, so every organisation using it would be affected.

The evidence published since places the tampered build in Cursor's marketplace only:

  • →StepSecurity ↗ downloaded Anthropic's 2.1.312 from Open VSX and verified it clean, a different file from Cursor's tampered 2.1.312, and found that 2.1.313 was never published to Open VSX or Microsoft's marketplace.
  • →Microsoft ↗ says the tampered packages never went through its marketplace, and that Anthropic confirmed its systems were not compromised.
  • →Anthropic's Felix Rieseberg wrote on X ↗ that it "wasn't a compromise of Anthropic's systems or employee laptops", and David Dworken said ↗ Anthropic was "not involved with building, publishing, or hosting this".
  • →Beaumont updated his post with Anthropic's statement, and later wrote ↗ that the exposure appeared to be for Cursor users only.

What the early framing caught is the name. Inside Cursor, the tampered build appeared under Anthropic's name: Beaumont says it was uploaded as Anthropic's verified account, and commenters on Hacker News ↗ describe Cursor's listing naming Anthropic as the publisher of a file Anthropic never made. Developers trusted a name that belonged to one company, in a store run by another.

Which stores carried what

Claude Code reaches developers through four stores. One of them served the tampered build.

Store2.1.3122.1.3132.1.314
Cursor's marketplaceTampered build, 29 Oct, macOS and WindowsTampered build, 29 Oct, macOS and WindowsServed after the rebuild; Cursor asks all users to update to it
Open VSXClean, published 27 OctNever publishedPublished 30 Oct, 01:08 UTC
Visual Studio Marketplace (Microsoft)Unaffected, Microsoft saysNever publishedPublished 30 Oct, 01:16 UTC
npm (the command-line tool)Published 27 OctNever publishedPublished 30 Oct, 00:12 UTC

Sources: Cursor; StepSecurity; Microsoft; the Open VSX ↗, Visual Studio Marketplace ↗ and npm ↗ records, checked on 31 October.

How an extension reaches your editor

Code editors built on VS Code install extensions from a marketplace and keep them current in the background. VS Code checks for updates and installs them automatically, and since June 2026 it waits before installing a newly published version: two hours at first, 12 hours by default today, according to its documentation ↗. Microsoft's marketplace signs every extension when it is published, and VS Code checks that signature on install.

Cursor is built on VS Code and uses a different store. Its help page ↗ says it takes third-party extensions from Open VSX ↗, the open registry hosted by the Eclipse Foundation, and routes searches and downloads through its own marketplace proxy. A proxy of this kind is a store in front of a store: it fetches from the registry, can add checks, and serves the result under whatever publisher name it shows. Cursor says it scans extensions for malware before serving them; this build was served for about 11 hours.

Cursor documents three controls of its own. An install cooldown (extensions.installCooldownHours, or Marketplace Install Cooldown for teams) holds back installs and updates until a version has been public for a set number of hours; the default is 0. Teams can limit installs to approved publishers, and enterprise teams can require a valid Open VSX signature.

Two earlier poisoned updates this year

Two earlier cases this year show the same channel, the one developers rely on to stay current, carrying an attacker's code:

  • →18 May: an attacker published a malicious version of Nx Console, an editor extension, to Microsoft's marketplace and Open VSX as a legitimate contributor, with a GitHub token stolen from that contributor's machine a week earlier. It was live for about 11 minutes on one and 36 on the other; Nx told anyone with auto-update on to assume compromise (Nx ↗).
  • →21 October: a malicious release of LiteLLM, the Python library that routes requests to AI model providers, sat on PyPI for under two hours; LiteLLM traces it to an administrative key left in a public repository's history (LiteLLM ↗; our piece on Black October).

Nx's chain began on one developer's machine and reached many more: by its own count, the bad version was activated about 6,000 times.

Binance and the timing

The window overlaps the Binance theft. Outflows from Binance's hot wallets began at about 20:05 UTC on 29 October, while the tampered build was still available, and Binance's first update ↗ said the incident may involve a compromised DevOps engineer's laptop. Commenters on Hacker News ↗ pointed to the overlap, and Beaumont wrote ↗ that Binance uses Claude Code on Cursor with this extension.

No one has linked the two incidents. Binance has not said how the laptop was compromised, and neither Binance, Cursor, Anthropic nor any investigator has connected it to the extension. TRM Labs' ↗ timeline has the attacker funding an operator wallet on 28 October, the day before the tampered build appeared, which on its own settles nothing either way. StepSecurity, which lists both incidents ↗, says such incidents "do not establish how its laptop was compromised". Our account of the Binance theft will say so if that changes.

Claims to stop repeating

  • →"Millions of developers were exposed." The 63 million downloads on Open VSX and 29 million installs on Microsoft's marketplace belong to the official extension, which was unaffected. Cursor puts the exposure at 5,000 users at most.
  • →"Only 2.1.313 was bad." Cursor's updated notice names 2.1.312 as well, a tampered file that shares its number with a clean Anthropic release.
  • →"Updating fixes it." Updating or uninstalling the extension leaves the key, the scripts and the start-up entries in place, Cursor and StepSecurity say.
  • →"The attacker got into thousands of machines." On most machines the SSH service stayed off, so the tunnel led nowhere, Cursor says; where SSH was already on, the planted key would work. Cursor has not said whether anyone logged in.

What is still unknown

  • →How the attacker got access to Cursor's marketplace, and for how long.
  • →How a build that never existed on Open VSX passed Cursor's checks and appeared under Anthropic's name.
  • →How many machines ran the code, how many had SSH running, and whether anyone logged in through a tunnel.
  • →How many users installed the build by hand, and how many received it as an automatic update.
  • →Who the attacker is. No one has been named.
  • →Whether Cursor's optional signature check would have refused the tampered build.
  • →Whether the overlap with the Binance theft means anything. No one has said it does.

We will update this piece when Cursor publishes its findings.

What to check this week

If Cursor installed or updated Claude Code for VS Code on 29 October, on macOS or Windows:

  • →Look for the key. Search ~/.ssh/authorized_keys, and on Windows also C:\ProgramData\ssh\administrators_authorized_keys, for svc-telemetry. A label can be edited, so Phorion suggests also matching the key's fingerprint, SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk.
  • →Keep the evidence, then clean. Collect logs first. Then remove the key, the com.apple.sysmond LaunchAgent, the SysMon task or Startup sysmon.cmd, any @reboot cron entry, ~/.config/.smt and .smtk, and stop ssh or autossh processes connecting to 134.209.82.225. Cursor's notice ↗ links remediation scripts for macOS and Windows.
  • →Update, then clean anyway. Version 2.1.314 replaces the extension and leaves the backdoor where it was.
  • →Rotate from a clean machine. Change the credentials the machine could reach, starting with those named in its environment variables, and consider rebuilding it.

For any team whose developers run VS Code, Cursor or another editor built on them:

  • →Set a cooldown. In Cursor, extensions.installCooldownHours or the team setting; in VS Code, extensions.autoUpdateDelay. A day's wait gives others time to find a bad release.
  • →Allow approved publishers only. Cursor's Allowed extensions setting limits installs to named publishers or extension IDs; Microsoft recommends the same restriction.
  • →Require signatures where offered. Turn on Cursor's signature verification for teams, and leave VS Code's signature check on.
  • →Pin what matters. Turn off auto-update for the extensions that can reach your code and keys, install a chosen version, and update deliberately.
  • →Watch for new keys and start-up items. A new line in authorized_keys, a LaunchAgent named like an Apple service or an unfamiliar scheduled task are cheap to alert on.
  • →Know what each machine holds. Keep an inventory of editors, extensions and versions per machine, with install history, and keep long-lived cloud keys out of developers' environments.

Rules that hold or break

Each of those checks can be written as a rule: no extension version younger than the cooldown runs on a developer machine; only approved publishers install; a new key in authorized_keys raises an alert the same day. Written down, a rule can be re-proven on every change, holding or broken. That is the practice ExploitOps describes; the rules page shows how rules are written, and our piece on three side doors covers the developer tools around them.

Sources

The logos are each company's own published icons. They identify the companies named in their public statements; MATT has no affiliation with Cursor, Phorion, StepSecurity, Nx, LiteLLM, Binance or TRM Labs.

Questions

Was Anthropic hacked in the Claude Code extension incident?

Anthropic says no: its systems and employee laptops were not compromised, and it did not build, publish or host the tampered extension. Cursor says the build was not developed by Anthropic; StepSecurity found it existed only in Cursor's marketplace, and Microsoft says it was never on Microsoft's. Version 2.1.313 was never published on Anthropic's channels.

Who was affected by the malicious Claude Code extension?

Cursor users on macOS or Windows who installed or updated Claude Code for VS Code to version 2.1.312 or 2.1.313 from Cursor's marketplace between about 09:27 and 20:35 UTC on 29 October 2026. Cursor says at most 5,000 users. People who installed from Microsoft's marketplace, from Open VSX directly or from npm were unaffected.

What did the malicious Claude Code extension do?

When the editor loaded it, it added an attacker's SSH key labelled svc-telemetry, tried to switch on the SSH service, opened a reverse SSH tunnel to the attacker's server, set itself to restart after a reboot, and sent the machine's details with the names, without values, of up to 40 environment variables. On most machines switching on SSH failed for lack of admin rights, so the attacker could not log in through the tunnel.

How do I check whether my machine is affected?

Search ~/.ssh/authorized_keys, and on Windows also C:\ProgramData\ssh\administrators_authorized_keys, for svc-telemetry, and compare key fingerprints against SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk. Also look for a LaunchAgent named com.apple.sysmond, a scheduled task named SysMon, files at ~/.config/.smt, and ssh connections to 134.209.82.225. Cursor's notice links remediation scripts.

Does updating or uninstalling the extension remove the backdoor?

No. Updating to 2.1.314 or uninstalling the extension leaves the planted key, the scripts and the start-up entries in place. Keep evidence, remove each item by hand or with Cursor's scripts, rotate credentials from a clean machine, and consider rebuilding the machine.

Is the Claude Code extension incident linked to the Binance hack?

No link has been established. The extension was available in Cursor's marketplace while Binance's outflows began, and Binance says its incident may involve a compromised engineer's laptop, but Binance has not said how the laptop was compromised and no investigator has connected the two.

How can a team protect itself from malicious extension updates?

Set an install cooldown so new versions wait before reaching developers, allow only approved publishers, require extension signatures where the editor supports it, pin the extensions that can reach code and keys, alert on new SSH keys and start-up items, and keep an inventory of extensions and versions on each machine.

Know where you stand.

Book a discovery call→