As of October 31, 2026, Beijing time, Cursor is still addressing a supply-chain security incident in its VS Code extension marketplace. The company updated its official notice on October 30 at 11:30 a.m. Pacific Time, adding indicators of compromise and identifying the affected versions as Anthropic.claude-code 2.1.312 and 2.1.313. The notice says these two maliciously modified versions were distributed by Cursor's marketplace to macOS and Windows users and were not developed by Anthropic; the disclosed scope does not include Anthropic's official distribution channels.
Distribution Window and Data Collection Scope
Cursor stated that the malicious versions were available for installation or update between 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, lasting approximately 11 hours and 8 minutes. The official limited the affected scope to macOS and Windows devices that obtained these two versions from Cursor's extension marketplace. The announcement did not include other Claude Code versions, extensions from other marketplaces, or Anthropic's official versions within the impact range, nor did it specify whether the same software had appeared through other third-party channels. The existing materials do not permit expanding the distribution boundaries based on this information.
According to Cursor's announcement, the malicious code would collect and transmit hostnames, usernames, operating systems, processor architectures, user home directory paths, environment variable names, working directories, Git configuration email addresses, and public IP addresses. The announcement lists environmental and host identification information, but does not disclose the scale of records sent, duration of collection, or actual storage conditions at the receiving end. It also did not confirm whether every installed device completed all collection actions. Reporting cannot conflate the code's capabilities, a single installation exposure, and confirmed data exfiltration results as identical facts.
SSH Path and Actual Execution Boundaries
Cursor also stated that the code attempts to append an attacker-controlled SSH public key to the authorized keys file, enable local SSH service, and establish a reverse SSH tunnel. The persistence component uses LaunchAgent on macOS and attempts to create a scheduled task with system privileges on Windows, falling back to startup scripts if that fails; the background script retries the tunnel approximately every 60 seconds. The announcement simultaneously provides file hashes, process, network, and key indicators for two versions on different systems, but this article does not reproduce the executable cleanup code or complete attack materials.
The outcomes of these actions need to be described separately. Cursor said that enabling local SSH service typically requires administrator privileges, and the malicious code itself contains errors, so this step will fail on most macOS and Windows devices where Cursor is not running with administrator privileges. In such cases, attackers cannot log in through the corresponding tunnel. However, the company simultaneously stated that the extension may still write the attacker's public key, install persistence components, and send host information. Failure of the first item cannot be rewritten as the entire malicious package not executing, nor can it be inferred that every device has been remotely controlled.
Platform Response and User Remediation
Cursor said it removed the malicious versions from the marketplace and blocked further distribution, then shut down the entire extension marketplace as a precaution. The company said it audited access records and found no other extensions had been tampered with; it then rotated its own keys, rebuilt the marketplace, and restored service. Cursor also said it worked with the hosting provider to take the attacker's server offline, so the listed reverse-shell and host-data submission endpoints no longer function. These response claims come from Cursor's notice, not an independent security audit.
Cursor instructs users who installed or updated either version from its marketplace during the specified period to run its check, review endpoint, network, and extension-installation telemetry, and isolate hosts showing evidence of payload execution or a backdoor. If relevant traces are found, remediation includes removing unauthorized SSH keys, persistence mechanisms, and tunnel processes, and assessing whether to rebuild the host; credentials and sessions accessible from an affected host should be rotated from a trusted system. Cursor says uninstalling the extension alone may not remove standalone persistence scripts.
Media Verification and Unconfirmed Matters
Ars Technica's public information stream recorded the same incident on October 30, 2026 at 21:09:54. The headline summarized the risk as a backdoor existing in the Anthropic VS Code extension on Cursor for nearly 12 hours. Its brief summary only added one boundary: how attackers obtained access to verified accounts in the Cursor market remains unclear. This entry corresponds with the official announcement's description of distribution channels and duration. This article does not use the full text or images from that media outlet, nor does it attribute details beyond the headline and brief summary to them.
The current materials still contain multiple gaps. Cursor did not disclose in the English announcement adopted in this report the confirmed number of affected users, nor did it reveal the attacker's identity, the method of accessing verified accounts, the actual execution results on each installed device, or the scope of credentials accessed. The previous partial localized announcement only listed version 2.1.313, while the current English announcement updated on October 30 now lists both versions 2.1.312 and 2.1.313. Therefore, this article adopts the latter and retains the process of the version list being clarified. The existing evidence only supports specific markets, systems, versions, and time periods, and cannot be extrapolated to the entire Claude Code ecosystem being compromised.