This Claude Code extension backdoor came from Cursor's own marketplace, not Open VSX as early reports claimed. A tampered version 2.1.313 of Anthropic's extension sat there for about 11 hours on October 29, and Cursor says at most 5,000 users were exposed. The payload attempted a persistent SSH backdoor, giving an attacker lasting remote access, and reportedly survives uninstall.
Key takeaways
- Cursor confirmed a tampered Claude Code 2.1.313 sat in its own marketplace for about 11 hours on October 29, exposing at most 5,000 users.
- Open VSX, the VS Code Marketplace and npm show no 2.1.313 release; a later UPDATE corrected the early Open VSX attribution.
- The payload attempted SSH persistence that reportedly survives uninstall, and no indicators are public, so triage happens on the host.
What shipped, and through which store?
The bad artifact was Claude Code 2.1.313 in the Cursor Marketplace, live for roughly 11 hours on October 29 per Cursor. Nothing points to a bug in Claude Code itself.
An early version of the original report (byline Ryan Merket) pointed at Open VSX. A later UPDATE named the Cursor Marketplace, which “experienced some form of compromise,” as the origin, “not Open-VSX.” On October 30, researcher @cyb3rops warned that misinformation about the incident was circulating.
Open VSX, Microsoft’s VS Code Marketplace and npm show no 2.1.313 release, and nobody has shown that Anthropic’s official distribution was touched. Still, a version string is publisher metadata, not proof two stores served the same bytes. Checking what each store actually ships is part of an AI supply chain security audit.
The sourcing is thin. The cited primary source is a post on X, and nothing published supplies hashes, file paths, infrastructure, a CVE or a named actor. The 5,000 figure is a ceiling, not a count of compromised machines.
Why is a Claude Code extension backdoor worse than a bad package?
Because the extension runs as you. Cursor and other VS Code-compatible editors load extensions into an Extension Host process with Node.js and the local user’s permissions. It is not a sandbox: extension code can read the workspace, spawn shells, open sockets and reach SSH keys, Git credentials and cloud tokens.
An AI coding agent is also expected to run terminal commands, so odd process activity blends in. It is the same trust path abused by malicious git configs that made coding agents run attacker code. The laptop is the foothold; every host it can SSH into is the blast radius.
What should a security lead check this week?
Removing the extension folder does not undo changes made elsewhere on the host, and a clean build installed today says nothing about what ran on October 29. Scope the check to users who installed Claude Code from Cursor’s marketplace in that window, then work the host.
- Preserve first. Record extension ID, version, install path, timestamps and endpoint logs before anyone reinstalls.
- Inventory. Read package.json under ~/.cursor/extensions (%USERPROFILE%\.cursor\extensions on Windows) for version and publisher.
- SSH trust. Review authorized_keys, any AuthorizedKeysFile directive in sshd_config and, on Windows, administrators_authorized_keys. Flag unexplained keys.
- Startup and processes. Hunt for new startup entries and unusual editor child processes around October 29.
- Rotate from a clean machine. Where persistence turns up, isolate the host and rotate SSH, Git, cloud and CI credentials from a known-good system.
In our engagements, one developer laptop often holds a deploy key or cloud profile that reaches production, and few teams monitor authorized_keys on workstations. Longer term, constrain what a coding agent may execute, for example with a runtime firewall for AI coding agents.
FAQ
Was the malicious Claude Code extension on Open VSX?
No. The report's UPDATE and Cursor's confirmation place the tampered 2.1.313 build in the Cursor Marketplace.
Does uninstalling Claude Code remove the backdoor?
Reportedly not. Check SSH trust files, startup entries and credentials on any machine that ran the build.
Was Anthropic's official Claude Code distribution compromised?
That has not been established. The only confirmed channel is Cursor's marketplace.
Is there a CVE for the Claude Code Cursor marketplace incident?
No. The reporting describes a tampered build in a distribution channel, not a vulnerability in Claude Code.
If your developers run AI coding agents with terminal and credential access, our AI agent penetration testing starts from a poisoned developer workstation and measures how far it reaches.