Cursor announcement: Between 2:27 AM and 1:35 PM Pacific Time on 10 29, the Anthropic.claude-code 2.1.312 and 2.1.313 (macOS, Windows versions) on its VS Code extension marketplace were maliciously modified versions, not developed by Anthropic. Upon loading, the plugin collects the hostname, username, system, home directory, environment variable names, Git email, and public IP address, sending them to the attacker. It writes the attacker's SSH public key (labeled svc-telemetry) into authorized_keys, attempts to enable local SSH, establishes a reverse tunnel, and uses LaunchAgent or scheduled tasks for auto-start on boot. Cursor has removed the version, taken the entire marketplace offline to rotate keys before restoring it, and worked with cloud providers to shut down the attacker's servers.
Confidence: High (100) · Event time 2026-10-29
Reasoning
- This is a supply chain attack on the distribution channel for AI programming tools: According to Ars Technica, citing Phorion and independent researcher Kevin Beaumont, the malicious versions were published from Anthropic's officially verified account on Cursor, overwriting the legitimate versions; Cursor automatically updates extensions by default, so users could be compromised without taking any action. Neither Cursor nor Anthropic has yet explained how the attacker obtained access to this account.
- The plugin runs with IDE privileges, allowing it to read local files, source code, and development tools. Phorion's analysis: It collects only environment variable "names" (matching KEY, TOKEN, SECRET, AWS, etc., up to 40 items) without their values, to inventory which machines have cloud credentials and API tokens, facilitating the selection of targets for subsequent attacks.
- The code has flaws: Enabling the SSH service requires administrator privileges, which will fail on most macOS and Windows machines, preventing the attacker from logging in via the tunnel; however, the public key, auto-start scripts, and host information reporting will still be completed, so the official recommendation is to clean up regardless.
Usage
- If you installed or updated this plugin from the Cursor extension marketplace during the aforementioned time window on 10 29: On macOS / Linux, run grep -qs svc-telemetry ~/.ssh/authorized_keys to check (use the PowerShell command from the announcement on Windows); finding a match indicates compromise.
- For affected machines, follow the Cursor announcement: Download the official remediate-macos.sh (run as a regular user, do not use root) or remediate-windows.ps1 (PowerShell as administrator) to remove the plugin, auto-start items, tunnel processes, and public keys; simply uninstalling the plugin is insufficient. Then rotate credentials and sessions accessible from this machine using a trusted device, and reinstall the system if necessary. Both the announcement and Phorion's analysis list indicators of compromise such as IPs, file paths, and hashes, which can be used for company-wide investigations.
Risk
- The statement that "up to 5000 users were affected" comes from The Decoder and Ars Technica relaying Cursor's claims; this figure is not present in the Cursor security announcement page.
- The description of affected versions has changed: Phorion initially listed only 2.1.313, but updated to 2.1.312 and 2.1.313 on 10 31 following Cursor's updated announcement; Phorion states that the malicious code also includes Linux logic, while the Cursor announcement lists only macOS and Windows.
- As of Ars Technica's publication, Anthropic has not issued a user-facing announcement; the cause of the account compromise and whether other distribution channels were affected remain undisclosed (Cursor states there is no evidence that other versions or official distribution channels were affected).
Open · Cursor Security Announcement · Phorion Security Analysis · Ars Technica