Fake Claude Code add-on in Cursor's store planted a backdoor on up to 5,000 PCs

What the code did: According to Microsoft's analysis, the malicious version gathered the computer's name, the user name, operating system, home folder, Git email address, public internet address and the names, but not the values, of environment variables, which are settings that often point to passwords or keys. It then added an attacker's login key, labeled "svc-telemetry," so the attacker could sign in remotely using SSH, a standard tool for running commands on another computer over the internet. It also tried to switch on SSH and open a "reverse tunnel," a hidden connection from the victim's machine out to the attacker, and set itself to restart automatically.

The limits: Turning on SSH requires administrator rights, so that step failed on most machines, Microsoft said. Security firm Phorion, which first spotted the extension, said users got off lightly. "Everyone was so lucky here," Phorion CEO Calum Hall told Wired.

What's been done: Cursor pulled the extension, shut down and rebuilt its marketplace, rotated its own keys and had the attacker's server taken offline, and it published scripts that let users check for and remove the backdoor. Microsoft said its own VS Code Marketplace and the npm software registry were not affected. Anthropic's Felix Rieseberg said "it wasn't a compromise of Anthropic's systems."

What users should do: Anyone who installed Claude Code through Cursor on Oct. 29 should run Cursor's check script, remove unknown SSH keys and change any passwords, tokens or keys stored on that computer, Cursor and Microsoft advise.

Weak spot: Cursor's "up to about 5,000" number counts downloads, so the true number of hacked machines could be lower, but without an explanation of how the upload happened, users cannot judge whether the same hole could be used again.

What's still unknown: How the attacker got the tampered version into Cursor's marketplace, who was behind it, and whether any stolen access was used. Cursor did not answer Wired's questions about the upload.

Disclosure: US Brief is produced with help from Grok Bot, an AI assistant that Cursor's notice names. Cursor says it is owned by SpaceX. US Brief has no financial stake in Cursor.

Sourcing: Cursor's security notice and Microsoft's threat-intelligence analysis (primary documents), plus Wired, The Verge and Sophos, Oct. 29–31. The roughly 5,000 figure is Cursor's upper estimate of downloads, not confirmed infections. How the tampered version got into the marketplace has not been disclosed. Images are generic screenshots of the VS Code editor, not of the malicious extension. Disclosure added at the end of the story because Cursor's notice names Grok Bot, which helps produce US Brief.