According to a Microsoft Security blog post dated October 30, 2026, a counterfeit build of the Claude Code extension (identifier anthropic.claude-code, versions 2.1.312 and 2.1.313) was distributed through the Cursor extension marketplace in an apparent supply-chain attack on Cursor users. Cursor reported that the malicious listing was live from about 2:27 AM to 1:35 PM Pacific time on October 29, 2026.

Scope of the incident

Microsoft states that the tampered packages were never published to the Microsoft Visual Studio Marketplace or to the npm distribution of Claude Code, and neither channel was affected. Anthropic told Microsoft that its systems were not breached and that it did not create the malicious package. Based on current evidence, Microsoft assesses the incident as confined to the Cursor marketplace. The case shows how an extension registry that mirrors or imitates trusted vendor listings can become a distribution route for malware aimed at developers.

How the loader works

Microsoft Threat Intelligence examined the JavaScript injected into the extension package. The code runs as soon as the extension module loads, before the legitimate extension logic, and uses Node.js capabilities to gather host information, edit files, and run operating-system commands. Output is suppressed and errors are silently swallowed, while the extension keeps working normally, so users have little reason to notice anything wrong.

The attack chain has five stages. First, the loader performs reconnaissance, collecting the hostname, username, operating system, architecture, home and working directories, and the global Git email. It also lists up to forty environment-variable names containing terms such as KEY, TOKEN, SECRET, PASS, AWS, or GCP. Only the names are reported, not the values, so this reveals what sensitive configuration may exist but does not by itself prove secrets were stolen.

Second, it prepares SSH access. The loader checks the user's authorized_keys file for an entry commented svc-telemetry and, if absent, appends an embedded Ed25519 public key, then tries to enable the local SSH service. Third, it establishes a reverse tunnel. A separate embedded private key, written to a hidden temporary file, authenticates an outbound connection to an attacker-run server using the account named tunnel. The SSH arguments request a server-allocated remote port that forwards to port 22 on the victim's loopback interface. Host-key checking is disabled and keepalives are set. On Unix-like systems the loader prefers autossh and falls back to ssh, while on Windows it uses a hidden PowerShell loop. Each loop waits sixty seconds before retrying after a disconnect.

Fourth, it sets up persistence. On macOS it creates a user LaunchAgent named com.apple.sysmond with RunAtLoad and KeepAlive, along with hidden helper files in the .config folder. On Linux it adds an @reboot crontab entry. On Windows it tries to register a SysMon scheduled task requesting SYSTEM execution, falling back to a batch file in the Startup folder. The names are chosen to look like legitimate monitoring components. Fifth, a delayed callback sends the collected host details to attacker infrastructure.

Limits on success

Microsoft cautions that code execution order does not prove every step worked on every machine. Remote access depends on host privileges, SSH configuration, and how the attacker's server is set up. Cursor reported that errors and administrator-permission requirements blocked SSH access on most macOS and Windows hosts. Even so, the loader can still write keys and persistence artifacts and report host data when the tunnel fails, so a failed tunnel does not make a machine clean.

Recommended response

Microsoft advises organizations to identify systems that installed or auto-updated to the affected versions via the Cursor marketplace, using extension-installation records and correlating endpoint, network, file, process, and authentication telemetry with the published indicators. Evidence such as the extension package, modified SSH authorization files, generated keys, scripts, and startup configuration should be preserved before cleanup, and devices showing loader execution should be isolated. For remediation, administrators should inspect ~/.ssh/authorized_keys on macOS and Linux for the svc-telemetry key and, on Windows, check both the user's authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. The key should be matched against the published fingerprint before removal. Credentials should be rotated and sessions revoked when investigation points to exposure. Microsoft also provides detections and hunting queries, noting they should be used after coverage and query validation.

Industry implications

AI coding assistants are privileged tools that run inside developer environments with access to source code, cloud credentials, and SSH keys. That makes branded extensions attractive impersonation targets, especially on marketplaces that are not the vendor's primary distribution channel. The episode is a reminder for AI tool vendors to monitor third-party registries for lookalike packages, and for enterprises to enforce extension allow-lists, verify publishers, and monitor for changes to SSH configuration on developer workstations. Anthropic is a victim of brand abuse here rather than a source of the compromise, while Cursor faces scrutiny over its marketplace vetting and its handling of takedown and disclosure.