Cursor says that on October 29, between about 2:27 a.m. and 1:35 p.m. Pacific, its VS Code extension marketplace served maliciously modified versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension for Windows and macOS, versions not made by Anthropic. The code ran as soon as the extension loaded: it sent host and user details to the attacker, added an attacker SSH key labeled "svc-telemetry" to the user's authorized keys, tried to enable SSH and open a reverse tunnel, and set up persistence. Cursor says errors in the malware meant the SSH step failed unless Cursor ran with admin rights. It pulled the versions, shut down and rebuilt the marketplace, rotated keys and had the attacker's server taken offline. Affected users should run its check, remove the key and persistence, and rotate credentials; uninstalling alone may not be enough.

The security firm Phorion, which also detected it, published a technical analysis, including the macOS permission-check mistake that skips turning on Remote Login.