A tampered version of Anthropic's own Claude Code extension sat inside Cursor's marketplace for about 11 hours on October 29, 2026, and reached as many as 5,000 users. People are already calling it the Claude Code extension breach, even though Anthropic says its own systems were never touched. The malware tried to plant an SSH backdoor and quietly reported which environment variables on your machine looked like API keys or secrets. If you run Claude Code inside Cursor, here's what actually happened and what to check this week.
What Actually Happened in the Claude Code Extension Breach?#
Two tampered versions, 2.1.312 and 2.1.313, were live in Cursor's marketplace for Windows and macOS from roughly 2:27am to 1:35pm Pacific on Thursday, October 29, according to Cursor's own security notice and reporting from The Next Web. Security firm Phorion flagged it first. Its co-founder and CTO, Luke Roberts, told Ars Technica that version 2.1.313 was posted straight to the official Anthropic account on the marketplace, superseding the real 2.1.312.
The tampered code collected your hostname, username, Git email, and public IP, then tried to add the attacker's SSH key and open a reverse tunnel. Cursor says that part usually fails since it needs admin rights the extension doesn't have. The key and persistence scripts still landed on affected machines, though, and Cursor warns that uninstalling the extension alone may not remove them.
Does This Affect You If You Don't Use Cursor?#
No, not directly. This backdoor lived specifically in Cursor's extension marketplace. Claude Code installed straight into VS Code, or run from a terminal, was never in its path. If that's your setup, this particular incident changes nothing for you.
At WebEpex we've run Claude Code as a managed DevOps layer on a crypto trading platform client's infrastructure since earlier this year, and extension version-pinning became the one change we rolled out across every client VPS the same week this broke. If you or anyone on your team installs Claude Code through Cursor, you were technically in the blast radius for those 11 hours, whether anything actually reached you or not.
Segmenting this honestly: if your team never touched Cursor's marketplace on October 29, or you don't run Claude Code at all, you can stop reading here. If you do, keep going, because the part that matters isn't the backdoor. It's what it tells you about trusting a marketplace "official account" badge on its own.
The Honest Trade-Offs Here#
Cursor's response was fast, credit where it's due. It pulled the marketplace, rotated keys, got the attacker's server taken offline, and shipped a clean build plus removal scripts within about a day. For a plugin ecosystem this size, that's a tight turnaround.
The gap: nobody has explained how the attacker got publishing access to "the official Anthropic account" on Cursor's marketplace in the first place. Phorion's account and Anthropic's own public statements don't fully line up on that point yet. An unpatched access hole is worse than one bad extension version, because it can get reused.
My honest read is that the 11-hour window and the "needs admin rights it doesn't usually have" caveat make this smaller than the headline suggests. I'd still rather hear about this from a security researcher's blog than from a client's incident report. Right now, that's the only way most of us heard about it at all.
How We're Handling This on Client Builds#
The same logic that applies to credential hygiene on dormant AI agents applies here: the attack worked by reading what your environment variables are named, not by brute-forcing anything. So this week we audited which variables actually exist on the VPS behind that trading client's build versus which ones strictly need to be there, the same way we treat connected business software after the Cathedral breach. Fewer loosely-named secrets sitting around is a smaller target, no matter which tool gets compromised next.
My bet, and this is a bet, not a confirmed fact, is that marketplace publishing-access bugs like this one get more common before they get rarer. Every AI coding tool now ships with a plugin ecosystem nobody's finished securing, the same pattern we flagged when PHP2Shell forced a same-day patch cycle on anything still running vulnerable PHP. We've already moved every client VPS we manage across GCC, European, US, and Indian builds onto pinned extension versions instead of auto-update. Small change. It's exactly the kind that would have mattered here.
What I'd Tell a Client Asking About This#
Update Claude Code to version 2.1.314 if you're on Cursor, today, not this week. Run Cursor's removal script. It checks for the SSH key and persistence scripts a plain uninstall won't catch. If you were actively coding between 2:27am and 1:35pm Pacific on October 29, rotate any API key or token that lives in an environment variable on that machine, even if nothing looks wrong yet. If you're not on Cursor at all, the only action item is the boring one: know which extensions auto-update on every machine your team codes from. That setting is what turned an 11-hour window into a real incident for 5,000 people.
If you want someone to look at what's actually running on your dev machines or your client-facing VPS before the next one of these drops, send me what you're on and I'll tell you straight. Two minutes, no pitch. cal.com/webepex/growth-review
