Cursor users faced a software-supply-chain incident and a separate vulnerability disclosure on October 29, after a tampered Claude Code extension appeared in the company’s marketplace and researchers reported an escape from Cursor’s built-in browser. The more urgent incident involved Anthropic’s anthropic.claude-code extension, which Cursor said was modified by an unknown party and was not developed by Anthropic. Cursor’s security notice says the malicious package was available from about 2:27 a.m. to 1:35 p.m. Pacific time.
The compromised releases were versions 2.1.312 and 2.1.313 for Windows and macOS. Reporting indicates the package reached at most 5,000 users during its roughly 11-hour distribution window. The injected code executed when the extension loaded, collecting host and user information including the hostname, username, operating system, home-directory path, working directories, configured Git email and public IP address. It also gathered environment-variable names that could reveal where credentials or tokens were stored, according to analysis published by Microsoft.
The payload attempted to append an attacker-controlled SSH key labeled svc-telemetry to authorized_keys, enable the local SSH service and establish a reverse SSH tunnel to 134.209.82.225. It also tried to maintain access through a macOS LaunchAgent or Windows scheduled task, with fallback startup scripts. Cursor said implementation errors and the need for administrator privileges meant the remote-login portion would fail on most systems unless Cursor had been launched with elevated rights. The key installation, persistence attempts and host-data collection could still succeed, however, and uninstalling the extension alone may leave dropped files and processes behind. [1]
Cursor removed the packages, temporarily shut down its extension marketplace, rotated marketplace keys, rebuilt the service and took the attacker’s server offline. Users who installed either affected version during the exposure window should use Cursor’s platform-specific remediation scripts, check for the svc-telemetry key and related persistence, isolate systems showing indicators of compromise, and rotate credentials and sessions accessible from those machines. The vendor’s notice does not assign a CVE or provide a CVSS score, and there is no evidence in the notice that the incident affected Anthropic’s official distribution or other Cursor extensions.
The same day, researchers at Forever Security described a separate arbitrary-code-execution path involving the browsers built into Cursor and other AI development tools. According to The Register, the researchers disclosed the Cursor issue to the vendor on September 10, and Cursor silently patched it on October 1. The report did not identify a CVE or CVSS score, and the episode underscores a broader risk for AI-assisted IDEs: extensions and embedded browsing features can turn developer workstations into high-value targets even when no malicious prompt or code change is visible.
