Cursor Security Breach: Fake Claude Code Extension Check

Cursor has published the full findings on its recent Cursor security breach, in which a fake copy of Anthropic’s Claude Code extension was planted in its VS Code extension marketplace on 29 October 2026. In an update dated 13 November, the company says the attack began with an access key that its vendor Fireworks exposed, that at most 5,000 users may have received the malicious build, and that it believes the incident is contained. If you installed Claude Code versions 2.1.312 or 2.1.313 from Cursor’s marketplace that day, you need to check your machine.

Quick summary

What happened: an attacker used a key Cursor had issued to Fireworks to copy data, found credentials in it, and later planted a tampered Claude Code extension.
Malicious versions: Anthropic.claude-code 2.1.312 and 2.1.313, for Windows and macOS, from the Cursor VS Code Extension Marketplace.
Exposure window: about 11 hours on 29 October 2026 (roughly 2:27 am to 1:35 pm Pacific Time, which is about 2:57 pm IST on 29 October to 2:05 am IST on 30 October).
Who is affected: at most 5,000 users, according to Cursor.
What it did: collected host details and tried to install a persistent SSH backdoor.
Not Anthropic’s fault: Cursor says Anthropic did not publish the copy and that this was not a flaw in Anthropic’s product.

Three steps of the Cursor breach: vendor key exposed, credentials found in traces, fake extension planted — Image: TeQBlogs

What happened in the Cursor security breach?

Cursor’s account describes a chain of three steps. First, an attacker obtained an access key that Cursor had issued to Fireworks, a third-party training and inference vendor. Cursor says the key was exposed by Fireworks. The attacker used it to copy data from a read-only storage bucket that held limited coding agent traces, mostly from 2025, from sessions that were not in Privacy Mode.

Second, a small number of those traces contained credentials that had not been redacted. Using them, the attacker reached some of the SaaS tools Cursor uses and accessed archived non-production source code, limited customer support data and emails, usage metrics, contact details and some credentials that users had sent to support.

Also read: emSign Certificate Distrust: What Changes on 16 November and What to Do

Third, on 29 October, the attacker used a stolen credential to place tampered copies of the Claude Code extension on the cache that serves Cursor’s VS Code extension marketplace. Cursor says the upstream source, Open VSX, never contained the malware. The company removed the files, took the marketplace offline and worked with the hosting provider to shut down the attacker’s server.

What did the malicious extension do?

According to Cursor’s security notice, the tampered extension:

Collected and sent host and user details, including hostname, username, operating system, working directories, the configured Git email and public IP address.
Tried to add an attacker-controlled SSH key, labelled svc-telemetry, to the machine’s authorised keys.
Tried to switch on the local SSH service and open a reverse SSH tunnel back to the attacker.
Tried to make that tunnel permanent with a LaunchAgent on macOS or a scheduled task on Windows.

Cursor says turning on the SSH service needs administrator rights, which the extension did not have on most machines, so on those hosts the attacker could not have logged in. The key and the persistence scripts were still installed, so Cursor asks everyone affected to clean up regardless.

Video: Pexels

How to check if your computer is affected

Four checks after the Cursor breach: version, svc-telemetry key, remediation script, rotate credentials — Image: TeQBlogs

Check your extension version. You are at risk only if you installed or updated to Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code Extension Marketplace on macOS or Windows during the exposure window.
Look for the attacker’s key. On macOS, search ~/.ssh/authorized_keys for the text svc-telemetry. On Windows, check authorized_keys in your user’s .ssh folder and C:\ProgramData\ssh\administrators_authorized_keys. Cursor’s notice gives ready-made commands for both.
If the key is there, isolate the machine from the network.
Run Cursor’s remediation script for your platform, downloaded only from Cursor’s own security notice. It removes the extension, the persistence files, tunnel processes and the SSH key.
Rotate credentials and sign out sessions that were reachable from that computer, and do it from a different, trusted device.
Consider rebuilding the machine if there is any sign the backdoor was used.

Cursor warns that uninstalling the extension alone may not be enough, because the payload drops separate scripts that keep running.

What was exposed and what was not

Area	Cursor’s finding
API credentials in traces	Exposed for less than 0.01% of customers
Coding agent traces (not in Privacy Mode)	Exposed for fewer than 0.05% of users; all notified
Prompts and code in Privacy Mode	Not affected
Live traffic and active inference requests	Not exposed
Production systems and official Cursor app updates	Not affected; no release signing keys exposed
Other marketplace extensions and plugins	Verified as authentic
Customer code repositories	Not affected

Cursor says it has contacted every affected customer directly. If you did not receive a notification, it says your data was not in the exposed traces.

What Cursor has changed

Moved all inference traffic off Fireworks and cut off its access to shared data.
Rotated every exposed credential, then all credentials across its internal systems.
Rebuilt the VS Code extension marketplace and verified the other extensions.
Added secret scanning across its code repositories and other internal data.
Redeployed production infrastructure and brought in external forensics experts.

Lessons for developers and IT teams in India

Many Indian startups and IT services teams use AI coding tools every day, and this incident shows how a problem at one vendor can travel down the chain to a developer’s laptop. A few habits reduce the damage:

Never paste API keys, passwords or tokens into an AI chat, a coding agent prompt or a support ticket.
Use privacy modes where they exist, so prompts and code are not kept for training.
Keep keys short-lived and limited in scope, and rotate them on a schedule.
Pin or review extension updates on work machines instead of auto-updating everything.
Monitor developer laptops for new SSH keys, scheduled tasks and outbound tunnels.

If your company needs help reviewing endpoint and access security, Suprams’ cybersecurity team can assist. Related reading: how to secure AI agents, the SSHole OpenSSH flaw, the Citrix NetScaler bulletin and the most common cyber security threats.

Frequently asked questions

Was Claude Code itself hacked?

No. Cursor says Anthropic did not publish the malicious copy and that this was not a vulnerability in Anthropic’s product. The tampered files were placed on Cursor’s marketplace cache.

Which Claude Code extension versions were malicious?

Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS, served from the Cursor VS Code Extension Marketplace on 29 October 2026.

Is it enough to uninstall the extension?

No. Cursor says the payload installs separate persistence scripts, so you should run its check and remediation script and rotate credentials.

Is Cursor safe to use now?

Cursor says it believes the incident is contained, that the last attacker activity it saw was on 1 November and was blocked, and that its app, updates and production systems were not affected.

The bottom line

The Cursor breach started with a vendor’s exposed key and ended with a backdoored extension on developers’ machines. Most users were not affected, but if you installed Claude Code 2.1.312 or 2.1.313 from Cursor’s marketplace on 29 October, check for the svc-telemetry key today, run Cursor’s remediation script and rotate your credentials.

Sources

(Visited 1 times, 1 visits today)

About The Author

TeQBlogs Desk

See author's posts