Cursor marketplace served trojanized Claude Code 2.1.312 and 2.1.313: Fireworks key led to SSH backdoor, up to 5,000 users

Cursor has confirmed how attackers planted a tampered copy of Anthropic's Claude Code extension in its own extension marketplace: they started from an access key that Fireworks AI had exposed, found credentials inside stored coding-agent traces, and used one taken from internal systems to write to the marketplace cache. The malicious versions were 2.1.312 and 2.1.313 of anthropic.claude-code, and Cursor says at most 5,000 users could have received them. If you installed or updated that extension in Cursor on 29 October 2026, treat the machine as possibly compromised: removing the extension is not enough.

Key points

• Cursor's marketplace served tampered copies of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, on 29 October 2026 for about 11 hours, according to Cursor.
• Cursor says at most 5,000 users who requested those cached versions on that day may have received them. The number of machines actually compromised is not confirmed.
• The code tried to add an attacker's SSH key labelled "svc-telemetry" to ~/.ssh/authorized_keys, open a reverse SSH tunnel and install persistence, according to The Hacker News.
• Cursor says fewer than 0.01% of customers had API credentials compromised and fewer than 0.05% of users had coding-agent traces exposed.
• Anthropic says it was "not involved with building, publishing, or hosting" the tampered copies, according to Implicator. The Hacker News reports that its own systems were not compromised.

What to do

Who is affected: anyone who installed or auto-updated anthropic.claude-code to 2.1.312 or 2.1.313 from the Cursor marketplace on 29 October 2026. The Hacker News reports a window of roughly 2:27 a.m. to 1:35 p.m. Pacific time that day. Cursor's own incident update says the copies were available for about 11 hours, and Anthropic's figure, as relayed by The Hacker News, is about 12 hours.

Not affected, per the vendors: copies installed from the Microsoft Visual Studio Marketplace or Open VSX. Cursor says Open VSX never carried the malware, and Microsoft confirmed to The Hacker News that the version was never published to its marketplace. An early version of one report named Open VSX, and was later corrected.

What to do now:

1. Check which version of the Claude Code extension each machine in Cursor has, and when it was installed or updated.
2. If it was 2.1.312 or 2.1.313, follow the remediation steps in Cursor's 29 October security notice. Cursor says uninstalling alone may not be enough. We could not open that notice page directly, so we are not repeating its steps here.
3. Look for the artefacts described by The Hacker News: an entry labelled "svc-telemetry" in ~/.ssh/authorized_keys, a new scheduled task (Windows), crontab entry (Linux) or LaunchAgent (macOS), and traffic to 134.209.82.225 on port 8099, path /beacon.
4. Preserve evidence, isolate the host, remove the unauthorised key and persistence, and rotate credentials that were reachable from that machine, ideally from a known-clean one. Removing or updating the extension does not remove files written outside its install folder, according to guidance from Microsoft quoted by The Hacker News.
5. Team admins who received a list of exposed keys from Cursor should rotate those keys. Questions go to security@cursor.com, per Cursor.
6. Reinstall the extension only once the machine is clean. Security researcher Kevin Beaumont, quoted by Implicator, says Anthropic replaced the bad version with 2.1.314; check the version and publisher yourself before trusting it.

What happened

Cursor published an update on 13 November, after about two weeks of investigation. It lays out the chain like this.

An access key that Cursor had issued to Fireworks, its inference provider, was exposed by Fireworks. The attacker used it to copy data from a read-only storage bucket the two companies shared. Some coding-agent traces in that bucket contained credentials that had not been redacted. Using those, the attacker reached select SaaS tools Cursor used. Then, with a credential taken from internal systems, the attacker placed malicious copies of the Claude Code extension in the cache that serves Cursor's VS Code marketplace on 29 October. Cursor removed them about 11 hours later. The last attacker activity Cursor saw was on 1 November, and it was blocked. The post does not say when the first access to the Fireworks key happened.

Cursor describes the copies as malicious, unauthorised builds that Anthropic did not publish. Anthropic told reporters that a malicious actor used access to Cursor's marketplace to publish the tampered extension and that it was "not involved with building, publishing, or hosting this", as relayed by Implicator on 31 October. The Hacker News reports Anthropic's position that none of its systems or employee laptops were compromised.

Background

This is the latest of several incidents tied to the same supply chain. We have already covered the Fireworks AI breach and the Railway breach, where stolen AI keys cost an estimated $740,000. BleepingComputer, summarising the wider picture, says Wiz has called the wave of attacks on AI developer platforms "Black October" and lists Railway, OpenCode, Warp and Notion among the affected. We have not independently verified that list.

Editor extensions are an attractive target. They run with the developer's own permissions, update automatically and sit on machines full of keys. Cursor's marketplace is a mirror of the open registry rather than Microsoft's own store, which is why a compromise of Cursor's cache did not touch the other marketplaces.

How the malicious extension worked

According to The Hacker News, the malicious code was a loader of about 66 lines placed before the legitimate code in the extension's main JavaScript bundle. It ran after VS Code started and when the extension's webview opened. It then:

• added the attacker's SSH key to ~/.ssh/authorized_keys under the label "svc-telemetry";
• tried to enable the local SSH service on Windows, Linux and macOS, which needs administrator rights and often failed;
• opened a reverse SSH tunnel to an attacker-controlled server;
• installed persistence through a scheduled task, a crontab entry or a LaunchAgent;
• sent reconnaissance over unencrypted HTTP: public IP (looked up through api.ipify.org), hostname, username, OS and architecture, home and working directories, the global Git email, and the names (not values) of up to 40 environment variables containing words such as KEY, TOKEN, SECRET, PASS, AWS or GCP.

No other follow-on payloads were observed. BleepingComputer reports that researchers found coding errors that probably stopped the backdoor working on many Windows and macOS systems where SSH was not already enabled. That lowers the chance that any given machine was actually opened, but it is not a reason to skip the checks above.

The numbers

Cursor's own figures describe the size of the exposure, and all of them are upper bounds or thresholds, not confirmed counts:

• Malicious build: at most 5,000 users who requested the cached versions on 29 October.
• API credentials: fewer than 0.01% of customers.
• Coding-agent traces from users without Privacy Mode: fewer than 0.05% of users.

Data Cursor says was accessed: limited coding-agent traces, mostly from 2025, from sessions not in Privacy Mode; some unredacted credentials in them; archived, non-production source repositories, some with business contact information; limited customer support data and email conversations; product usage metrics and contact details; summaries of some coding-agent conversations; and some credentials users had sent to support.

What it means

For developers: an extension update is code execution on your machine. Pin or review extension versions where you can, treat marketplace mirrors as separate trust domains, and keep long-lived keys out of the environment variables an editor process inherits. The beacon's list of variable names containing KEY or TOKEN shows what attackers look for first.

For tool vendors: the incident is a reminder that logs and traces are data stores. Unredacted credentials inside coding-agent traces were the step that turned a partner's exposed key into access to Cursor's internal systems. Cursor says it has added secret scanning across code repositories and expanded it to other data sources.

For Anthropic and other publishers: a clean upstream release does not protect users who pull from a third-party mirror. The Hacker News reports that official channels (the Microsoft marketplace and Open VSX) were not affected.

For Fireworks customers: Cursor has moved all inference traffic off Fireworks and deactivated its key. Other customers of any shared-storage arrangement should ask what is stored there and who holds keys to it.

What we don't know yet

• Cursor gives no date for the initial access to the Fireworks-issued key, no total count of affected users and no full forensic timeline.
• The exact method used to place the update is described by The Hacker News as unclear.
• How many machines were actually backdoored is unconfirmed. 5,000 is a ceiling.
• Reports differ on the exposure window: about 11 hours (Cursor, BleepingComputer) versus roughly 12 (Anthropic, via The Hacker News).
• We did not open Cursor's remediation notice, so any step or indicator beyond those reported by the outlets below should be taken from Cursor directly.

What to watch next

• Whether Cursor publishes the full forensic report it has commissioned from external experts.
• Whether Fireworks, Cursor and other affected firms publish fuller accounts of the shared-bucket access.
• Whether other editors that mirror open registries change how they cache and verify extensions.

Sources

• Cursor: security incident update (primary source)
• BleepingComputer: Cursor confirms security breach led to malicious Claude Code extension
• Implicator: Anthropic says a malicious actor used access to Cursor's marketplace
• The Hacker News: trojanized Claude Code extension on Cursor's marketplace