According to a Medium post by Kevin Beaumont dated 30 October 2026, a tampered version 2.1.313 of the Anthropic.claude-code extension was distributed through the Cursor extension marketplace and installed a persistent SSH backdoor on developer machines. Anthropic says the breach happened at Cursor, not at Anthropic, and Cursor says around 5,000 developer systems were affected.
What the malicious extension did on developer machines
The post describes a backdoor that collects host and user details, including hostname, username, operating system, architecture, home directory path, environment variable names, working directories, the configured Git email address and the public IP address. It then tries to add an attacker-controlled key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel.
Persistence depends on the operating system. On macOS the post says the tunnel is kept alive through a LaunchAgent. On Windows it uses a scheduled task that tries to run as SYSTEM, with a Startup-script fallback. Background scripts retry the tunnel roughly every 60 seconds, and the host reports its status over HTTP POST to port 8099.
The author notes one limit in the attack. Unless Cursor was started with administrator privileges, the SSH step would fail because of errors in the malicious code. The post does not say how common that condition is, so a failed setup should not be read as a clean machine.
Who was responsible, and what the statements say
Anthropic's statement, quoted in the post, says a malicious actor used access to Cursor's marketplace to publish a tampered extension, and that Anthropic was not involved in building, publishing or hosting it. The post also quotes a Cursor blog statement that the malicious version was not developed by Anthropic.
The author disputes that wording. The package was uploaded under Anthropic's verified account, so in his view the word developed sidesteps the central point, which is a supply chain attack that reached users through a trusted publisher name. The source does not explain how the attacker got access to Cursor's marketplace.
The post also says Anthropic has not informed customers and that the malicious version was removed without notice. The source does not say whether a formal customer notice has since been published, and none is quoted.
Which version is affected, and what the fix does not cover
According to the post, the compromised version was 2.1.313. Anthropic replaced it with 2.1.314, which the author says appears to remove the backdoor from the extension. He adds that he is not sure the new version is free of malicious code.
The update does not help machines that are already infected. According to the post, it does not remove the SSH backdoor from systems already compromised, nor the earlier reconnaissance activity. The post also says the extension auto-updated inside Cursor to the malicious version, so users who never chose to install it may still have it.
Phorion was the first to notice the malicious activity on endpoints, according to the post. The author says 2.1.313 is missing from OpenVSX, the Visual Studio Marketplace and Cursor.
How to check whether your machine was affected
The post lists indicators that defenders can compare against their own systems. Treat them as a starting point, not a complete checklist.
- Check whether the installed Anthropic.claude-code extension is version 2.1.313. Compare the VSIX hash with the values in the post: 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62 for the darwin-arm64 (Mac) package, and 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 for the modified win32-x64 package.
- Look for unexpected keys in authorized_keys, and for a LaunchAgent (macOS) or scheduled task (Windows) that you did not create.
- Review network logs for connections to 134[.]209[.]82[.]225 on port 22, and for HTTP POST requests to /beacon on port 8099 at that address.
- If you run Microsoft Defender for Endpoint, use the KQL queries the author published in his ThreatHunting repository on GitHub, in the file AnthropicSupplyChainAttack.kql.
The post notes that public IP lookups to ifconfig[.]me and api[.]ipify[.]org are legitimate services, so access to them alone is not an indicator. It also lists a loopback request to 127[.]0[.]0[.]1:8099/beacon as a local beacon attempt. If the checks find anything, treat the machine as compromised and involve your security team. The source does not give a removal procedure.
Who needs to act, and what the sources leave open
Anyone who has Cursor installed with the Claude Code extension should check the installed version now, and IT teams that manage developer laptops should check every machine that may have auto-updated. The post is one author's account of an emerging situation, and he says he will post updates on Mastodon.
Several questions remain open in the source. It does not confirm whether 2.1.314 is clean, whether the roughly 5,000 systems Cursor cites is the full count, how the marketplace access was obtained, or whether customers will receive formal notice.
Bottom line: If you use Cursor with the Claude Code extension, check for version 2.1.313 and the indicators above first. Moving to 2.1.314 is not enough on its own if the machine was already infected.
Source and verification: This article is based on a Medium post by Kevin Beaumont, published 30 October 2026, which quotes statements from Anthropic and Cursor and cites a security advisory from Phorion. No GitHub repository figures or verified facts were supplied for this article, and the attack details have not been independently verified here.
Related: Anthropic Reportedly Limits Claude on Video Game Reverse Engineering · Anthropic Expected to Receive High Junk Rating After IPO
Comments (0)