Fake Claude Code Extension on Cursor's Marketplace Hid an SSH Backdoor

Quick show of hands: who actually checks who published an extension before installing it? Exactly. That's the whole story here.

On October 29, Cursor published a security notice nobody wants to write: two versions of an extension called "Anthropic.claude-code" on its marketplace (2.1.312 and 2.1.313, for Windows and macOS) were malicious. Not buggy. Malicious by design.

What it actually did

This wasn't a spray-and-pray info stealer. According to Microsoft's technical breakdown, the extension collected information about the victim's machine, then did something much nastier: it wrote the attacker's SSH key into the user's authorized_keys file and opened a persistent reverse SSH tunnel.

Uninstalling the extension does not clean that up. The persistence scripts stay behind, quietly keeping the door open. That's the detail that turns "oops, bad extension" into "rotate your keys and check your machine."

Cursor says up to 5,000 users may have been affected. Anthropic confirmed its own systems were never compromised and that the extension did not come from them - it was a fake trading on the Claude Code name.

The marketplace trust problem

Here's the uncomfortable part. Extension marketplaces run on borrowed trust. We see a familiar brand name, a plausible icon, a decent download count, and we click install. The review processes at most marketplaces are somewhere between "light" and "nominally present."

Cursor has since shut down its marketplace and rebuilt it, which tells you how seriously they're taking it. But the pattern is bigger than one editor: VS Code forks, browser extension stores, package registries - anywhere third-party code gets one-click installs, someone is trying this.

Worth repeating what Microsoft stressed in its analysis: Anthropic's own infrastructure was not breached, and Claude Code itself is fine. The attackers simply rented the most trusted name they could find. That's supply-chain security in 2026: the weakest link is rarely the product, it's the shelf it sits on.

What to do about it

If you used Cursor recently, the boring-but-necessary checklist: check the vendor's security notice for the affected versions, look for unexpected entries in your authorized_keys, and treat any machine that ran the malicious builds as potentially compromised.

For everyone else, the takeaway is simpler. Install extensions from verified publishers, side-eye anything trading on a famous name, and remember that your code editor has the keys to, well, everything.

We like free tools around here, and open ecosystems are worth keeping. But "open" only works if we stay honest about its failure modes.

Sources: cursor.com/blog/claude-code-extension-securit microsoft.com/en-us/security/blog/2026/10/30/