On Thursday, tampered builds of Anthropic's Claude Code extension — versions 2.1.312 and 2.1.313 — were published to Cursor's extension marketplace carrying a malicious loader embedded in the legitimate `extension.js` bundle. According to StepSecurity, which verified the payload in a sandbox, the build was the official extension in every respect except one: a small loader that ran the moment the extension module loaded. No Claude conversation was needed. Simply opening Cursor with the auto-updated extension was enough to get owned.
The payload was built for persistence, not a quick hit. It planted an attacker-controlled SSH key labeled `svc-telemetry` into the machine's authorized keys, installed per-OS persistence — a LaunchAgent called `com.apple.sysmond` on macOS, a `SysMon` scheduled task with a startup-script fallback on Windows — opened a reverse SSH tunnel, and beaconed host reconnaissance back over plain HTTP. Cursor says the step of enabling the local SSH service requires administrator privileges, so the interactive-access half of the attack failed on most machines. But the rest didn't: the key was still planted, the persistence still stuck, and the reconnaissance — hostnames, usernames, environment variables matching KEY, TOKEN, SECRET, PASS, AWS and GCP, configured Git emails, public IPs — still went out. Uninstalling the extension does not remove the persistence, which keeps running on its own.The trust angle is the one worth sitting with. This wasn't a typosquat: the tampered build appeared under the legitimate publisher identifier and rode the auto-update channel developers trust implicitly. The first headlines read as "Anthropic got hacked," and Anthropic had to correct the record: its systems and employee laptops were never touched. Per Felix Rieseberg, a malicious actor used access to Cursor's marketplace to publish a tampered copy Anthropic did not build; 2.1.313 never appeared on Open-VSX, the Microsoft marketplace, or any official host — Anthropic skipped to 2.1.314. Cursor pulled the builds, took its entire marketplace offline, audited the catalog, rotated its keys, and rebuilt; the command-and-control server has been taken offline with its host's cooperation.
This is the most intimate kind of breach: the tool that writes your code now phones home to someone else, from the most trusted channel in your stack. If you ran either version from Cursor's marketplace on October 29, Cursor's remediation is blunt: grep your authorized keys for `svc-telemetry`, tear out the persistence artifacts, and rotate every credential that machine could reach — from a machine you know is clean.
— via StepSecurity