I have spent years telling clients that the most dangerous software on a developer's machine is rarely the software they distrust. It is the software they trust completely — the editor extension installed without thinking, from a marketplace assumed safe, carrying a name they already know. On October 29, 2026, that trust got weaponised, and the details matter more than the headline.
A tampered version of the Claude Code extension appeared in Cursor's extension marketplace. According to Microsoft's Security Research investigation, published on October 30, the affected versions were 2.1.312 and 2.1.313. StepSecurity's analysis, also published on October 30, put the reach at up to 5,000 Cursor users. The malicious extension was available for several hours before it was caught — a short window, but an eternity when an installer runs with the privileges of a working developer machine.
Let me be precise about what was and was not compromised, because early chatter blurred that line. Anthropic clarified that its own systems were not compromised, and that it did not develop the malicious package. Microsoft clarified that the incident was limited to the Cursor marketplace: the official Visual Studio Marketplace and Anthropic's npm package were not affected. If you installed Claude Code from those official channels, this incident did not touch you. If you installed it from Cursor's marketplace and got version 2.1.312 or 2.1.313, act as though your machine was exposed, even if everything still looks fine.
What the Tampered Extension Actually Did
What makes this incident scarier than most malicious extensions is that this one kept working. Microsoft's investigation found that the tampered extension could continue functioning normally as a coding assistant, which made the malicious activity far less obvious. There was no crash and no error dialog. You could have been chatting with Claude, getting perfectly good code suggestions, while the payload did its real job in the background.
That job, according to Microsoft's investigation, had several stages. First, the extension collected information about the infected computer. Second, it attempted to add an unauthorized SSH key. Third, it enabled SSH access on the machine. Fourth, it established reverse SSH tunnels. Fifth, it created startup mechanisms designed to maintain persistent access. And sixth, it attempted to send collected system information to external infrastructure.
Read that list slowly. An unauthorized SSH key means someone else can log in as you. A reverse tunnel means they can reach your machine even behind a firewall. A startup mechanism means the access comes back after a reboot. This was not a prank extension that changed your theme. It was a remote-access implant wearing a coding assistant's clothes.
StepSecurity described the payload the same way: persistent remote-access mechanisms. That word, persistent, is the point. Uninstalling the extension removes the delivery vehicle. It does not remove an SSH key added to your authorized keys file, a tunnel configuration, or a startup entry.
Why a Coding Assistant Is the Perfect Disguise
To understand why this attack worked, you have to understand what an AI coding assistant is from a security point of view. It is not a text editor plugin in the old sense. A modern coding assistant reads your codebase, runs commands in your terminal, and can reach your environment variables, deployment keys, and cloud tokens. We grant these tools extraordinary access because their value is doing useful work across our entire development environment.
That is precisely what makes a compromised coding assistant so dangerous. An attacker who controls your assistant does not need to find a vulnerability in your application. They already sit inside the machine where the application is built, tested, and deployed from. Your
.env files, SSH keys, Git credentials, and API tokens all live within reach of the same user account that runs the editor. A supply-chain attack on the assistant skips the hard part of hacking and goes straight to the workstation.The branding mattered too. Claude Code is a real, well-known product, so developers searching Cursor's marketplace would have had no reason to be suspicious of the name, and many would not have scrutinised the publisher closely. That is not a criticism of those developers — it is a criticism of the assumption that a marketplace listing with a familiar name is a safe listing. Marketplaces are software distribution channels, and every distribution channel can be poisoned.
There is a second reason the disguise worked: timing. AI coding tools are being adopted so fast that security review has not kept pace. Teams that would never let a developer install an unvetted binary on a production server will happily let the same developer install a dozen editor extensions on a laptop that holds production credentials. The laptop is treated as personal space. But for a developer, the laptop is production infrastructure. It builds the thing, signs the thing, and deploys the thing.
What to Do Tonight If You Use Cursor
I am going to give you the checklist I would run, in order. The confirmed first step is to check whether you installed the affected versions — 2.1.312 or 2.1.313 — from Cursor's marketplace, and to follow Cursor's incident guidance. If your team has a security contact, tell them first, before cleaning up on your own, because a coordinated response catches machines you might have forgotten about.
Next, check for the persistence mechanisms the investigation described. Look at your SSH authorized keys file — on macOS and Linux,
~/.ssh/authorized_keys — for any key you do not recognise. Check whether SSH is enabled on a machine where you did not deliberately enable it, and look for unfamiliar startup items or launch agents that appeared around October 29. None of this requires exotic tooling; it requires twenty careful minutes and treating "I don't remember adding that" as a finding, not a shrug.Then rotate credentials, and be generous about what counts. If the machine held GitHub tokens, cloud API keys, database passwords, WordPress admin credentials, deployment keys, or signing keys, rotate them. You cannot prove a negative — you cannot prove the attacker did not copy a credential that sat on that machine — and rotation is the only way to close that uncertainty. Pay special attention to anything that lets an attacker move from your laptop into a server or client site: deploy keys, CI tokens, and hosting passwords are the bridge from a compromised workstation to a compromised website.
Finally, tighten the rules going forward. Restrict extension installations on work machines to approved publishers, pin versions for critical extensions, and review the extensions you already have — most developers carry extensions installed once for a tutorial years ago and never thought about again. Every one of those is a standing trust decision you made and forgot.
What This Means for WordPress and Website Owners
You might be reading this thinking you do not use Cursor, so this is someone else's problem. I would push back on that. The developers and agencies who build WordPress sites are exactly the people who use AI coding assistants, and a compromised developer workstation is one of the fastest routes to a compromised website. An attacker with your deploy key does not need to find a vulnerability in your theme. They push code.
There is also a direct parallel to WordPress. Site owners have lived through this exact pattern with plugins and themes: a trusted channel, a familiar name, a payload hidden inside something that keeps working normally. The defences are the same: keep an inventory of what is installed and where it came from, update from official sources, use unique credentials for every site and service, and turn on two-factor authentication everywhere it is offered.
For agencies, there is an organisational lesson too: if five developers all installed the same extension on the same day, you have a coordinated exposure, not five individual incidents. That is why extension allowlists are a team policy, not a personal preference — and why the first question after any incident should be: which of our machines had this extension, and which version?
The Bigger Picture: AI Tools Need Supply-Chain Security
Zoom out, and this incident sits in a pattern that has been building all year. AI coding tools are becoming critical infrastructure for software development, but they are being distributed and governed like casual consumer apps. The same week this story broke, CrowdStrike reported an AI-assisted espionage campaign targeting more than 200 organisations. The common thread is that AI is no longer a side experiment. It is the toolchain, the target, and the weapon, sometimes all at once.
That means the security conversation around AI tools has to grow up fast. Extension marketplaces need stronger publisher verification, faster takedown, and clearer incident communication. Vendors need to sign and verify extensions so tampering is detectable, not merely unlikely. And development teams need to extend the same supply-chain discipline they apply to npm packages and Docker images to the tools that write their code. For years, developers treated the editor as personal space. That era is ending, because the editor now has the keys to everything: the teams that adapt will treat extensions like dependencies — pinned, reviewed, inventoried, and updated deliberately.
Conclusion
Here is the honest summary. A tampered Claude Code extension, versions 2.1.312 and 2.1.313, reached up to 5,000 Cursor users through Cursor's marketplace on October 29, 2026. Microsoft's Security Research and StepSecurity documented a payload that collected system information, added an unauthorized SSH key, enabled SSH access, opened reverse tunnels, created startup persistence, and tried to send data to external infrastructure — all while the extension kept working normally. Anthropic's systems were not compromised, and the official VS Code marketplace and npm package were not affected. The blast radius was limited to one marketplace, but within it, the damage was designed to outlive the extension itself.
If you were exposed, uninstalling is not enough. Check your SSH keys, startup items, and running processes. Rotate the credentials that lived on that machine, tell your team, and fix the process that let a familiar name install itself on a machine full of production secrets without anyone asking a question.
The AI coding revolution is real, and I use these tools every day. But trust in a tool is not a substitute for verifying it. This Halloween, the scariest story in tech was not a ghost. It was a coding assistant that did exactly what it was supposed to do — and something else besides.
Frequently Asked Questions
Which Claude Code extension versions were tampered with?
Versions 2.1.312 and 2.1.313 distributed through Cursor's marketplace, according to Microsoft's Security Research investigation published on October 30, 2026. StepSecurity's analysis put the reach at up to 5,000 Cursor users.
Was Anthropic hacked?
No. Anthropic clarified that its own systems were not compromised and that it did not develop the malicious package. The tampered extension was a Cursor marketplace listing carrying the Claude Code name, not an Anthropic release.
Was the official VS Code marketplace or npm package affected?
No. Microsoft clarified that the incident was limited to the Cursor marketplace. The official Microsoft Visual Studio Marketplace listing and Anthropic's npm package were not affected.
What did the malicious extension actually do?
According to Microsoft's investigation, it collected system information, attempted to add an unauthorized SSH key, enabled SSH access, established reverse SSH tunnels, created startup mechanisms for persistence, and attempted to send collected information to external infrastructure — while continuing to function normally as a coding assistant.
Is uninstalling the extension enough?
No, not on its own. Because the payload was designed for persistence — an added SSH key, tunnels, and startup mechanisms can survive removal of the extension — affected users should check SSH authorized keys, startup items, and running processes, follow Cursor's incident guidance, and rotate credentials that lived on the machine.
How can developers prevent this kind of supply-chain attack?
Install extensions only from verified publishers, pin versions for critical tools, keep an inventory of installed extensions, restrict installations on work machines to an approved list, and monitor for unexpected SSH activity.
