Claude Code on Cursor: an update with a backdoor

On October 29, 2026, between approximately 2:27 a.m. and 1:35 p.m. Pacific Time, Cursor’s extension marketplace offered tampered copies of Anthropic.claude-code, versions 2.1.312 and 2.1.313, for macOS and Windows. According to Cursor’s notice, they attempted to install a persistent SSH backdoor. Anthropic did not develop these malicious versions.

Installing an extension with a suspicious name was not required. The package appeared in the distribution channel for a familiar tool. Ars Technica reports that Cursor extensions update automatically by default and attributes an upper bound of “at most 5,000 users” to Cursor. That is a reported limit on affected users, not evidence that an attacker entered 5,000 machines.

Checking whether a machine was exposed means checking which versions it ran and how it received updates. Automatic updates allow an installed extension to change without anyone reviewing its permissions again.

Phorion’s analysis describes injected code at the beginning of extension.js. It ran when the module loaded, before the normal activation callback. It did not depend on a person asking the model to perform a dangerous task.

The implant attempted to add an attacker-controlled key to authorized_keys, enable the local SSH service and open a reverse tunnel: an outbound connection through which the operator could reach the machine’s SSH service. It also wrote mechanisms to maintain access after closing the editor or rebooting, including a macOS LaunchAgent and a Windows scheduled task with a login-startup fallback.

It also sent reconnaissance data: host, user, operating system, directories, Git email and public IP. Phorion identified collection of up to 40 credential-related environment variable names, not their values. A name such as AWS_ACCESS_KEY_ID tells the attacker what to look for if they gain access later. The reconnaissance described did not itself disclose that key.

The malware had bugs. On macOS, its Remote Login check could misinterpret a permissions response and skip SSH enablement. If the service was off, the tunnel alone was not enough to get in. If it was already on, the situation was different. Cursor also describes privilege limitations on macOS and Windows. Even if interactive access failed, the planted key and persistence could remain, and reconnaissance data could already have been sent.

Approving a tool call controls an action proposed by the agent. An extension executing code on load can act without reaching that approval. Asking the model not to read secrets does not control that code.

Claude Code’s plugin security documentation warns that an installed plugin can execute arbitrary code with user privileges. Its permission rules and sandbox cover Claude’s tool calls, not all code a plugin runs independently. Hooks and server processes also need review.

Each component needs a different review. A text skill influences instructions; a hook executes commands; a local MCP server runs as a process; a remote server receives the data and credentials it is granted. Include them in the same inventory and record each component’s permissions, without assuming they can all read the entire disk.

On the machine, that means checking which files the process can read, which variables it inherits and which sessions or credentials it can use. Access depends on the environment and on controls applied outside the model.

The Register quotes an Anthropic technical staff member saying its systems and laptops were not compromised; an actor used access to Cursor’s marketplace to publish a copy Anthropic neither built nor published. A complete public technical explanation of how the actor obtained that access is still missing. The information available does not support attributing the incident to a breach of Anthropic.

Forever Security’s EMBRACE research provides context, not another stage of this attack. It describes different embedded-browser flaws: code execution in Cursor, tab-address spoofing in GitHub Copilot, and local file reads in Codex, VS Code and Claude Desktop. It does not claim that all five share one vulnerability or the same impact.

Both investigations lead us to review the software that accompanies the agent. They do not establish a coordinated campaign, allow an industry compromise rate to be calculated or show that every plugin is malicious. We worked with public sources here: we did not execute the malware, reproduce EMBRACE or audit AE’s laptops.

These are the checks we propose based on the incident. We have not verified their deployment across all our machines, and they do not constitute a security certification.

1. Record the installed extensions, plugins, skills, hooks and MCP servers. For each, note the actual source, version or commit, machine or repository, owner and update mechanism. The publisher’s name alone does not establish where the package came from.

2. In sensitive environments, disable unattended updates where possible and install reviewed versions. Someone must own urgent patches and have a deadline for applying them; leaving a version frozen indefinitely also accumulates risk. Pinning a version does not establish integrity if its provenance cannot be verified.

3. Avoid running the editor as administrator and keep production credentials out of the agent’s working environment. File, network and identity restrictions should be enforced through the execution environment rather than depend on model instructions.

4. Use temporary, task-specific credentials. A secrets manager helps if the process can retrieve only what it needs. Moving a token out of .env and injecting it globally into the editor preserves much of the problem.

5. Prepare the incident response: which machines ran each version, what evidence to preserve, who can isolate them and how to revoke sessions and rotate credentials from a trusted system. Today’s installation list cannot by itself reconstruct what ran yesterday.

A shared table can hold that information:

Consult Cursor’s updated notice and indicators. The vendor recommends searching endpoint, network and installation evidence; isolating hosts showing execution or backdoor indicators; removing keys, persistence and tunnels; and assessing whether the machine should be rebuilt. Uninstalling or updating the extension is not enough to remove independent scripts.

Cursor reports removing the packages and having the hosting provider disable the attacker’s server. That disrupts that infrastructure; it does not replace examining endpoints. It recommends rotating credentials and sessions accessible from affected machines from a trusted system. Reconnaissance collecting only variable names does not rule out subsequent access to their values.

Do not treat an isolated command copied from this note as a complete diagnosis. Response needs the vendor’s updated scope and evidence from your environment.

Before adding another agent, choose one representative machine and repository. Complete the inventory without copying secret values. Separate confirmed facts from unknowns and assign an owner to each missing detail. The first finding might simply be a dependency that updates itself and whose approval nobody can account for.

At Agentic Engineering, we propose including this review when designing an agent workflow. The person operating it needs to know what it can execute, under which identity and how to withdraw its access. In our note on evaluation containment, we examine a related check: what an environment described as “isolated” can actually reach.

Bring the inventory to the next team review. For each component without a confirmed source, version or owner, agree who will check it and when.