We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.

------

Check whether you are impacted

The malicious extension appends the attacker's public key, labeled svc-telemetry, to your SSH authorized keys. To check for it:

On macOS, run:

   grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

   $files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
   if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

[1] https://cursor.com/blog/claude-code-extension-security-notic...

> Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday

So is this or isn't this from Anthropic and how did this happen?

https://phorion.io/blog/offical-claude-code-vsx-compromise/

EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.

EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:

> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.

[1]: https://code.visualstudio.com/api/working-with-extensions/pu...

That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:

> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace

https://cursor.com/blog/claude-code-extension-security-notic...

> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.

You can't even configure which publishers you "trust"...

What appears to be an official Binance account reporting it also:

https://www.binance.com/en/square/post/10-30-2026-claude-cod...

it looks like anthropic folks in this thread are throwing excuses instead of allocating one оr two FTE to make sure this will not happen

Or are they using an Open VSX Managed Registry hosted by the Eclipse Foundation, in which case this is potentially a bigger deal?

An official announcement from Anthropic would be nice!

I don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?

Still, it’s hardly a surprise that best practices are rarely followed with any consistency.

A system where ~/.ssh/authorized_keys has not been modified might be a hint that this did not execute - the article does not mention self cleanup/reverting to previous status behavior by the malware. By default /var/log/auth.log is only of marginal value because outbound SSH connections are not logged by default.

Given how many people likely share ChatGPT subscriptions, this seems highly problematic.

> This extension is not updated yet because new versions become eligible for automatic update 12 hours after they are published. It will become eligible in 2 hours.

It doesn't appear that the Claude Code harness itself was compromised, was it? or Cursor if you use Anthropic models via Cursor's API itself?

Lately I've been using a script that mounts my current working directory in a container and I put all my build tools in a Dockerfile. I also map the harness config (~/.config/opencode or whatever) to a named volume to minimize the chance a harness could grab other things off my host. I can't use it if I ask the LLMs for docker work since they need the docker socket and then all bets are off (it could just mount your root volume somewhere). I sure I could use a full QEMU VM or some other type of isolation for such devops tasks, but I haven't really looked into it yet. Guess I should.

https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...

So Cursor is running its own extension repository? Or is this the official VS Code repository and the incident report just happens to focus on Cursor for some reason?

1. Open Cursor.

2. Press Ctrl + Shift + P.

3. Search for Preferences: Open User Settings (JSON).

4. Add:

{

    "extensions.installCooldownHours": 72

}

This is a joke (neovim user here).

That part is probably obvious.

But in the long term, I suspect this will get worse.

Attackers will still need to think critically to be a few steps ahead of the defenders.

But the defenders will increasingly outsource their thinking to AI as they are incentived if not outright forced to dumb themselves down into interchangeable cogs.

Notable customers who run Claude Code and Cursor on laptops include Binance, amongst thousands of others.

Did the Claude Code plugin hack cause the Binance theft? The timing seems like an incredible coincidence.

Claude Code was already malware, but with this attack you cannot trust the vendor either.

In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.

strongly suggest put your valuable work on local llm.

The amount of problems it's had from compromised extensions is ridiculous.

This is fine.

I forbid all-things-Anthropic on any machine I control, as of many months ago. In my private vendor "DNP" blacklist. Its designed as bait for the gullible or ignorant: the telltales are all right there. (Just like OpenClaw, for example.)

Whoa! WTF? I always thought those were official releases by the companies. That's the only reason I trusted them. How is it possible they are being branded as official releases?

[1] https://github.com/cookiengineer/check-claude-code-exfil

Hats off to the hackers.

We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.