A fake Claude Code extension planted backdoors through Cursor. What it means for your office

What happened

Cursor is a popular AI code editor. Like Microsoft's VS Code, which it's built from, it lets people install extensions from a marketplace. One of the most popular is Anthropic's Claude Code extension, which puts Claude's coding assistant inside the editor.

On Oct. 29, Cursor posted a security notice. It said that between about 2:27 a.m. and 1:35 p.m. Pacific time, a maliciously modified version of the Claude Code extension was available in its marketplace. Cursor named versions 2.1.312 and 2.1.313 for Windows and macOS, and said Anthropic did not develop them.

According to Cursor's notice, the tampered extension:

• Collected details about the computer and user, including the username, computer name, configured Git email, public IP address and the names of environment variables.
• Tried to add the attacker's SSH key, turn on SSH and open a reverse tunnel so the attacker could log in from outside.
• Set itself up to keep retrying that tunnel about every 60 seconds, even after a restart.

The security firm Phorion first spotted it. BleepingComputer reported that the malicious code ran as soon as the extension loaded, exposing up to 5,000 developers. That figure is from press reports; Cursor's notice doesn't give a count.

What was overblown

A few early takes went further than the facts.

Anthropic says it wasn't hacked. Felix Rieseberg, a member of Anthropic's technical staff, said on X that it wasn't a compromise of Anthropic's systems or employee laptops, as reported by The Register. He said the versions on Anthropic's official channels weren't affected and only Cursor users were hit. As of The Register's Oct. 30 report, neither company had explained how the tampered copy got into the marketplace.

The backdoor mostly failed. Turning on SSH needs administrator rights. Cursor says that on most macOS and Windows machines the extension didn't have them, so that step failed and the attacker could not have logged in through the tunnel. Cursor also worked with the hosting provider to take the attacker's server offline.

But it still did damage. Even where the tunnel failed, Cursor says the extension added the attacker's key, installed its persistence scripts and sent host details out. And Cursor warns that uninstalling the extension may not be enough, because the scripts it drops keep running on their own.

An AI add-on gets the same access as the person who installs it.

Why an owner should care

Most 40-400 person manufacturers and distributors don't have a software team. So why does a developer tool matter?

Because AI tools are spreading past the IT department. Your ERP consultant, your one IT person, the operations analyst who builds reports, or the engineer who writes scripts for the CNC machines may all use AI coding tools now. So do contractors who log in to your systems. Phorion's write-up puts the risk plainly: extensions run with the permissions of the IDE and the user running it, so a bad one gets access to local files, code and developer tools as soon as it loads.

That's the part that applies to every office. A browser extension, an Outlook add-in or an AI app connected to Microsoft 365 is the same kind of thing. It runs as you. If it goes bad, it sees what you see.

It's also a reminder that a trusted name isn't proof. This extension carried Anthropic's name in a well-known marketplace. Nobody installing it did anything obviously careless.

What doesn't change

• This isn't a reason to drop AI tools. The official Claude Code extension wasn't the problem. Nothing in Cursor's notice points to a flaw in Claude itself; the attack was in how a copy of the extension was distributed.
• Admin rights still matter. The single biggest thing that blunted this attack was that most people weren't running as administrators. That's an old rule, and it worked.
• The basics still win. Know what's installed, keep people off admin accounts for daily work, and rotate passwords and keys when something looks off.

What to do this week

The last one connects to a bigger problem: most offices don't know which AI tools their people use at all. We cover that in shadow AI: your employees already use ChatGPT at work.

Where the other side has a point

A fair reader could say this was a near miss, not a disaster. The window was 11 hours, the attacker's server is down, and the backdoor's main trick failed on most machines. That's true. It's also true that the marketplace served it under a trusted name, and that how it got there hasn't been explained publicly. The right reaction isn't panic. It's a short inventory and an old rule about admin rights, done this week while it's fresh.