For about eleven hours on Oct. 29, the fastest way to install Anthropic’s Claude Code inside the Cursor editor was also the fastest way to give a stranger a login to a developer’s laptop. The extension carried the publisher’s own name and arrived as a routine version bump.
Cursor said a tampered copy of the extension, tagged versions 2.1.312 and 2.1.313, was served from its marketplace between roughly 2:27 a.m. and 1:35 p.m. Pacific time before it was pulled. Microsoft’s threat intelligence team and the security firm Step Security published separate analyses the following day. BleepingComputer put the number of exposed developers at as many as 5,000.
The injected code ran before the extension’s normal initialization, which meant it executed the first time the editor loaded and again on every restart. According to Microsoft’s reconstruction, it collected the hostname, the signed-in user, the operating system and architecture, the home and working directories and the global Git email address. It also scanned the environment for variable names containing terms such as KEY, TOKEN, SECRET, PASS, AWS or GCP, keeping as many as forty matches. It recorded the names, not the values.
It then opened a door. If the user’s authorized_keys file lacked an entry marked svc-telemetry, the loader appended an Ed25519 public key tagged with that comment and attempted to start the local SSH service. A second, separate private key, written to a hidden temporary file whose name began with .stk_ and ended with ten hexadecimal characters derived from the machine, authenticated an outbound connection to a server under the attacker’s control.
That connection requested a listening port on the remote host and forwarded traffic back to port 22 on the victim’s loopback interface. The design starts from the inside, so no inbound port has to be reachable from the internet and no firewall rule has to be wrong. Host key checking was disabled, keepalives were set, interactive prompts were suppressed.
Persistence came next. On Unix-like systems the loader preferred autossh and fell back to ssh; on Windows it used a hidden PowerShell loop. Both restart the tunnel sixty seconds after it drops. Command output was discarded and errors swallowed, so a failed step left no trace in a terminal. The extension itself kept working normally, which is the detail that let it sit for half a day.
The scoping statements were as notable as the code. Microsoft said the malicious packages were never published to the Visual Studio Marketplace or to the npm registry under Anthropic’s package name, and that Anthropic confirmed its own systems were not compromised and that it did not build the version served by Cursor. Cursor uses the Open VSX registry for third-party extensions and runs its own proxy in front of it, applying automated malware and supply-chain analysis before an extension is offered.
If those statements hold, the tampering happened at the layer of the publisher account rather than in a build pipeline, and the method by which someone reached that account has not been disclosed. That gap is the part enterprises should read twice. Extension stores rest on a single proposition: a verified publisher name means the code came from the company that owns it. Every subscriber who reads the publisher field did the right thing and was still compromised.
The economics of the marketplace explain why. An extension runs with the privileges of the editor, which is to say with the privileges of the developer, on a machine that holds cloud credentials, source code, signing keys and access to production systems. Updates install silently by default. A single publish action therefore reaches thousands of machines without a prompt, a review queue or a security ticket.
Developer tooling has been a target for years: typosquatted packages, dependency confusion, credential-stealing extensions dressed as themes and linters. The npm ecosystem spent much of 2025 contending with a self-replicating worm that harvested publishing tokens from maintainer machines and spread through packages that other packages depended on. What changed here is the target. AI coding assistants now sit on the same laptops as the cloud consoles they write code for.
Microsoft’s guidance for affected organizations was procedural rather than technical: identify systems that installed or automatically updated to the flagged versions, preserve evidence before cleanup, remove the artifacts, review endpoint and network telemetry for outbound SSH sessions, and rotate credentials or revoke sessions where the investigation indicates exposure. Its analysts also noted the limits of the intrusion. Whether remote access succeeded depended on local privileges, SSH configuration and the attacker’s server, though keys and persistence files could be written even where the tunnel failed.
For defenders, the indicators are usable. An authorized_keys entry commented svc-telemetry is anomalous on any developer machine. So is a hidden file matching .stk_ followed by ten hex characters, an SSH process running with a remote-forward flag against an unfamiliar host, and a PowerShell loop relaunching SSH every minute on a Windows workstation.
The harder lesson concerns update policy. Most engineering organizations allow extensions to auto-update because pinning creates its own maintenance burden, and because the alternative is an audit of every version bump. That trade assumes the publisher account is defended at least as well as the average corporate identity, an assumption nobody has tested publicly for the largest AI vendors.
Anthropic’s extension was not the weak point, and neither was Cursor’s scanner, at least not in any way either company has described. The failure sat in the middle of a chain that has four links, each owned by a different party, and no single one of them can see the whole thing. That is where the next incident will sit as well.
