A Tampered Claude Code Extension in Cursor: What an Editor Plugin Can See on an Admin PC

In brief: On 29 October 2026 the Cursor marketplace served the Claude Code extension in versions 2.1.312 and 2.1.313 with malicious code between 02:27 and 13:35 Pacific Time (11 hours 8 minutes). The code added a foreign SSH key, tried to open a reverse tunnel and reported host details to the outside. The first thing to do today is search every machine with Cursor for the string svc-telemetry in authorized_keys. Our result from 5 November: no hit, and Cursor has no Claude Code extension installed on our admin PC at all.

Cursor published its security notice on 29 October 2026. It briefly shut the whole marketplace down, rotated its keys, and says it had the attacker's server taken offline together with the hosting provider. The figure "up to 5,000 developers" comes from the press (The Register); Cursor's own notice gives no count. As of our check, neither Cursor nor Anthropic has explained how the tampered build reached the marketplace. Anthropic says its own systems and employee laptops were not compromised and that an attacker used access to Cursor's marketplace to publish a modified copy.

For us the incident matters for a different reason than for Cursor users in general. It shows how much a plugin holds in its hands when it runs on an administrator's machine, and it can be turned into numbers for our own inventory.

What an extension may do on an admin PC

An editor extension is code that runs in the editor's extension host with the same permissions as the editor and the signed-in user. According to the VS Code documentation, an extension can perform any action VS Code itself can perform (VS Code: Extension runtime security). Anthropic says the same about Claude Code plugins: a plugin can execute arbitrary code with the user's privileges (Claude Code: Plugin security and trust).

Phorion, an endpoint security vendor that The Register credits with spotting the problem first, shows what that looked like here. The attackers prepended an immediately invoked function to the extension bundle. It imports child_process, fs, os, path, http and crypto and runs as soon as Node loads the file, before the extension's normal activate (Phorion advisory). Opening the editor is enough.

For the data that left the machine, Cursor lists: hostname, username, operating system, architecture, home directory, the names of environment variables, working directories, the configured Git email and the public IP. Variable values are not on that list. Cursor also writes that this limited collection does not rule out later access through the backdoor.

What an arbitrary plugin can reach on an admin PC follows from those permissions and from what is stored there. On our admin PC the .ssh folder holds a private key, 61 Host entries in config and 195 lines in known_hosts. That is a map of our servers with a key to match. Whether the key has a passphrase we have not checked (see "Still to measure"). Any extension or plugin running as our user can read these files.

What is established about the time window, and what is not

The times from Cursor's notice: 02:27 to 13:35 Pacific Time on 29 October, which is 09:27 to 20:35 UTC (The Register) and 10:27 to 21:35 Central European Time (our conversion). That gives a duration of 11 hours and 8 minutes.

It is tempting to say that a twelve-hour update delay would have stopped the attack. This is our inference and has no source. It needs three assumptions that no source confirms:

1. The client honours the delay. VS Code documents extensions.autoUpdateDelay with a default of 12 hours, 0 meaning immediately, and the setting applies only while auto-update is on (VS Code: Extension Marketplace). The release notes for 1.125, which introduced the setting, said two hours at the time (VS Code 1.125). Which value applies in a given installation shows only in that version's default settings view.
2. The clock starts at publication on the marketplace, not when the client first sees the version.
3. Cursor follows this VS Code setting at all. Cursor's docs describe something different: an install cooldown in hours that team admins set, default 0 (off). Above 0 it applies fleet-wide and overrides a user's own extensions.installCooldownHours (Cursor: Extensions).

Cursor's docs also say that cooldown and signature verification are client-side checks and do not replace analysis in the marketplace. This case shows why: the malicious code came through the marketplace itself.

What updates itself in our setup

Docs read on 5 November 2026. For Claude Code the docs add that with auto-update on, the files of a plugin you reviewed can change in the background.

What we measured

On 5 November 2026 we looked read-only. On the admin PC (Windows 11, ARM64) we read the extensions.json files of VS Code and Cursor and Claude Code's installed_plugins.json and known_marketplaces.json. On the code-server container of our appliance (VM 116, 192.168.180.206, code-server 4.145.0) we read extensions.json over SSH. We changed nothing.

Three caveats belong with it. First, versions 2.1.287 in VS Code and 2.1.316 on code-server are outside the named range of 2.1.312 to 2.1.313, and the install on .206 happened after the incident. According to code-server's FAQ, extensions there come from the Open VSX gallery (code-server FAQ), and Cursor's docs say it also uses Open VSX, but through its own proxy (Cursor: Extensions). Neither Cursor nor Phorion says whether the tampered versions were also on Open VSX. We therefore treat .206 as not affected, without being able to prove it. Second, known_marketplaces.json has no autoUpdate entry for our marketplaces. We read that as the documented default, which is off for third parties, but we have not confirmed it in the interface. Third, the IOC hashes in Cursor's notice list packages for darwin-arm64 and win32-x64. Our PC is Windows on ARM64, and the notice does not say whether a tampered package existed for it.

The check for the key matches Cursor's:

grep -c svc-telemetry ~/.ssh/authorized_keys

Cursor also supplies a PowerShell variant that additionally covers C:\ProgramData\ssh\administrators_authorized_keys. We ran the check with grep and tested whether the second file exists.

A proposal for pinning and waiting

We derive a proposal from the sources and the measurements. This is our recommendation. No vendor requires it, and none of it has been decided or rolled out on our side.

• Extensions come from the marketplaces the editor itself prescribes, and every entry in the inventory gets a source and a version.
• On machines with server access, the delay in VS Code should be above 0, and in Cursor the cooldown should be set if a team manages it. The right value is open. It should be longer than the window in an incident like this one without leaving security updates untouched for days.
• For Claude Code plugins, leave auto-update off for third-party marketplaces, which is the documented default. Whoever updates a plugin reads the change first. The limits of a commit pin are covered in Plugin4Shell.
• With a private key without a passphrase in the home directory, any plugin running as that user can reach servers with it. Whether that applies to us is listed below as an open measurement.

The topic page Security and Privacy collects our posts on supply-chain problems like this one. How Claude Code plugins are built and what a mod may do is in Claude Mods: What the New Plugin Format Is Allowed to Do. What we offer in IT operations and hardening is under IT services.

Established and open

Established, with the primary source read:

• Versions 2.1.312 and 2.1.313, Windows and macOS, time window, data list, key name and tunnel attempt: Cursor.
• Malicious code at the start of extension.js, execution before activate, the flaw in the macOS check for the SSH service, a second key for the tunnel: Phorion.
• Anthropic's statement that its own systems were not compromised: The Register.
• Permissions of extensions and plugins, auto-update defaults and cooldown settings: the documentation in the source list.

Open:

• How the build reached the marketplace. Neither Cursor nor Anthropic has explained it.
• How many machines were affected. The 5,000 figure comes from the press with no derivation.
• Whether an update delay would have prevented the case. That remains an inference.
• The version details in the reports. The Register names only 2.1.313, while Cursor and Phorion name both versions.

Still to measure

We have not measured these four points. Until then there is no result here.

1. Does Cursor honour extensions.autoUpdateDelay, and which value is the default? Method: in Cursor open "Preferences: Open Default Settings (JSON)" and search for autoUpdateDelay and installCooldownHours. Both steps are read-only.
2. Which variable names does the editor process see? Cursor lists variable names as exfiltrated. Method: list the names in the editor's own terminal (Get-ChildItem Env: | Select Name) and compare them with the names in a normal terminal. No values are printed.
3. Does the private key on the admin PC have a passphrase? Method: ssh-keygen -y -P "" -f <keyfile> prints the public part without a passphrase and reports an error if one is set. We did not run it because it reads the key.
4. The remaining hosts: only the admin PC and code-server are measured. Method for each further host: read the editor's extensions.json and Claude Code's installed_plugins.json and record source, version and install date in one list.

Ten minutes for today

1. On every machine with Cursor or VS Code run grep -c svc-telemetry ~/.ssh/authorized_keys (Windows: Cursor's PowerShell command). Expected: 0.
2. Read the version of anthropic.claude-code in each editor. 2.1.312 or 2.1.313 from the Cursor marketplace means: run Cursor's cleanup script and rotate credentials.
3. Look up autoUpdateDelay and installCooldownHours in the settings and write down what they say.
4. Run claude plugin list and write down the source of each plugin.

All sources last checked on 5 November 2026.

Further reading

• Cursor: Security notice, 29 Oct 2026, versions, time window, check commands and IOC list
• Phorion: Official Claude Code Extension Compromise, analysis of the bundle, updated 31 Oct 2026
• The Register, 30 Oct 2026, Anthropic's statement and the 5,000 figure
• VS Code: Extension runtime security, permissions of the extension host
• VS Code: Extension Marketplace, auto-update and autoUpdateDelay
• Cursor: Extensions, cooldown, allowlist and signature verification
• Claude Code: Plugin security and trust, permissions and updates of plugins
• Claude Code: Install and manage plugins, auto-update defaults per marketplace