The Claude Code backdoor shipped under Anthropic's real name

What happened

On 29 October a modified build of Anthropic's Claude Code extension, anthropic.claude-code, was available in Cursor's extension marketplace between about 2:27am and 1:35pm Pacific. Cursor says the build "was not developed by Anthropic" and runs code that tries to install a persistent SSH backdoor. It pulled the version, took its marketplace offline while it audited access, and found no other tampered extensions (vendor, Cursor). Cursor puts the reach at "at most 5,000 users" (vendor, as reported by The Hacker News and Help Net Security). That is a window of about 11 hours (our maths, from Cursor's two times).

Anthropic has since published a clean 2.1.314. The Visual Studio Marketplace never carried the bad build (independent, Help Net Security).

The control that did not fire

This was not a lookalike. StepSecurity reports the Anthropic namespace on Open VSX belongs to an Anthropic employee, so the build appeared under the legitimate publisher identity rather than a typosquat (independent, StepSecurity). No source has established how the attacker got publish access.

Most enterprise extension policies are allowlists of trusted publishers. Anthropic was on every one of them. A publisher allowlist answers "who is this from?" It does not answer "is this the build that publisher shipped?" The only checks that would have caught it are version pinning with a delay before auto-update, or comparing the package against the publisher's other channels.

The version trap

Most coverage names 2.1.313. Cursor's own notice, updated on 30 October, lists modified builds of 2.1.312 and 2.1.313 for Windows and macOS in its marketplace, with separate file hashes for each (vendor). StepSecurity, checking Open VSX, verified a clean 2.1.312 published there on 27 October (independent).

Both can be true: the copy of 2.1.312 that Cursor users received is not the copy StepSecurity checked. The practical consequence is that "roll back to the last good version" is the wrong instruction for anyone on Cursor. The floor is 2.1.314.

What it does, and what it sends

On load, the loader adds an attacker key with the comment svc-telemetry to ~/.ssh/authorized_keys, installs persistence (LaunchAgent com.apple.sysmond on macOS, scheduled task SysMon on Windows, a cron @reboot entry on Linux), and retries a reverse SSH tunnel to 134.209.82.225 about every 60 seconds (vendor, Cursor; independent, StepSecurity). It does not need a Claude conversation to run.

Cursor says turning on the local SSH service needs admin rights the extension does not have on most Macs and Windows machines, and errors in the code make that step fail anyway (vendor). That lowers the risk on a default laptop. It does not lower it on machines that already run an SSH server: Linux development boxes, Macs with Remote Login switched on, and remote development hosts. On those, a planted key and a live tunnel are enough.

The beacon also sent the names, not the values, of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP (independent, StepSecurity and The Hacker News). That list tells an attacker which credentials exist on the machine. Use the same list to decide what you rotate first.

Five steps

1. Step 1. Find the installs. Sweep developer machines for extension folders named anthropic.claude-code-2.1.312 or -2.1.313, and for svc-telemetry in authorized_keys. Owner: endpoint engineering.
2. Step 2. Isolate the hits. Treat any match as compromised. StepSecurity says uninstalling the extension alone is not enough, and that if the tunnel connected, rebuilding the host is safer than cleaning it. Owner: security operations.
3. Step 3. Remove persistence. Run Cursor's remediate-macos.sh as the affected user or remediate-windows.ps1 from an elevated PowerShell. Both exit non-zero if anything remains (vendor). Collect evidence first. Owner: security operations.
4. Step 4. Rotate from a clean machine. Start with the credentials whose variable names were on that machine: source control, CI/CD, cloud, SSH, and package registry tokens. Owner: platform engineering.
5. Step 5. Change the policy. Pin extension versions on managed editors and delay auto-update by a few days, so a bad build has to survive public scrutiny before it reaches you. Owner: CISO.

Publishing a clean build is Anthropic's job. Knowing which of your machines took the bad one is ours.

Missing

• How the attacker got publish access. No source has established it.
• The window for the modified 2.1.312. Cursor names it but gives no times for it.
• A settled answer on whether Open VSX itself served the build to other editors.
• A statement from Anthropic. We found none beyond the clean release.