What happened
Microsoft Security says Cursor reported on October 29, 2026 that tampered copies of the anthropic.claude-code extension, versions 2.1.312 and 2.1.313, had been available in Cursor's extension marketplace for a few hours. Cursor reported a window from about 2:27 a.m. to 1:35 p.m. Pacific Daylight Time. Microsoft says the packages were not published or distributed through the Microsoft Visual Studio Marketplace or npm's @anthropic-ai/claude-code package. Anthropic confirmed to Microsoft that its systems were not compromised and that it did not develop the malicious package. Microsoft says available evidence indicates the incident was limited to Cursor's marketplace.
The injected JavaScript ran when the extension module loaded, before its expected code. Microsoft says the extension continued functioning normally, while the loader used Node.js APIs and built-in system tools to collect host information, modify files and execute operating-system commands. It collected the hostname, username, operating system, architecture, home and working directories, and global Git email. It also searched for environment-variable names containing terms such as KEY, TOKEN, SECRET, PASS, AWS or GCP, retaining up to 40 matches. Microsoft explicitly distinguishes those names from values: its analysis does not demonstrate that the secrets stored in those variables were stolen.
The loader attempted several steps, and Microsoft cautions that code execution order does not prove every step succeeded on every machine. It checked the user's authorized_keys file for the marker svc-telemetry and, if absent, appended an embedded Ed25519 public key. It then wrote a separate private key for an outbound SSH connection, attempted to enable the local SSH service and requested reverse forwarding to the workstation's SSH port. The analysis identifies 134.209.82.225 as the tunnel destination. A delayed callback attempted to report collected host details. Successful remote access depended on local privileges, SSH configuration and the attacker's server configuration; even if tunnel access failed, the loader could still write keys and persistence artifacts.
The report describes persistence methods across platforms, including a LaunchAgent, crontab or scheduled task. It includes indicators of compromise, Microsoft Defender detections and hunting queries, as well as investigation and recovery guidance. Microsoft advises organizations to identify systems that installed or automatically updated to the affected versions, preserve evidence, remove confirmed malicious artifacts and review endpoint and network telemetry. Credential rotation or session revocation is appropriate when investigation indicates exposure. Uninstalling the extension is not, by itself, a cleanup step for artifacts the loader may have created.
What the archive adds
This is a follow-up analysis of the same incident covered in Malicious Claude Code extension v2.1.313 hit Cursor's marketplace, exposing up to 5,000 developers. Microsoft adds a technical account of the loader, its attempted SSH access and persistence, and detection and recovery guidance; this is new detail on a known event, not a separate incident.
Trend signal
The incident supports agent security moves to runtime boundaries: a coding extension's local runtime permissions, SSH configuration and persistence mechanisms shaped the risk more directly than the extension's stated purpose. The case also illustrates why extension installation and update paths need security controls, but the supplied pattern is specifically about runtime boundaries.
Why now
Cursor's reported exposure window was on October 29, and Microsoft's technical analysis was published October 30, 2026. The report makes the incident actionable by giving defenders indicators and investigation steps while affected systems may still need forensic review and cleanup.
Why it matters
AI coding extensions run inside developer environments that often contain source code, credentials, build tools and access to internal systems. A malicious update can therefore create risks beyond the editor itself. Here, the injected code attempted to authorize SSH access and establish a reverse tunnel, while also setting persistence; those actions can survive the user's decision to uninstall the extension. At the same time, the report does not establish that every attempt worked or that secrets were exfiltrated. Teams should treat affected installations as an incident to investigate, not assume either a successful compromise or a clean bill of health. The practical lesson is to track extension versions and publishers, preserve evidence, inspect host and network artifacts, and revoke credentials or sessions when investigation supports doing so.
Limits and uncertainty
Microsoft's analysis describes capabilities and attempted actions in the injected code, not successful compromise on every machine. Whether remote access worked depended on host privileges, SSH configuration and the attacker's server setup. The report says the loader collected names of up to 40 secret-looking environment variables, not their values, and does not establish that stored secrets were stolen. It also says available evidence points to Cursor's marketplace, but does not provide a confirmed count of affected installations in the supplied material. Defenders need host-level investigation to determine which artifacts were written and whether access occurred.
Reader takeaway
For teams using Cursor, identify machines that installed or automatically updated to Claude Code extension versions 2.1.312 or 2.1.313 during the reported window. Do not treat uninstalling the extension as sufficient: investigate and remove confirmed SSH and persistence artifacts, review telemetry, and rotate credentials or revoke sessions if the evidence indicates exposure.