A supply chain attack hit developers last week, and it came through a tool many agencies now use every day. A fake copy of the Claude Code extension sat on the Cursor marketplace for about 11 hours. It tried to plant a hidden SSH backdoor on every Windows and Mac laptop that installed or auto-updated it.

I'm Nitin, and I coordinate projects for teams that live inside AI code editors. This one got my attention fast. Below is what happened, how to check your machines, and the simple controls I'd add this week.

What Happened in the Cursor Supply Chain Attack

On October 29, 2026, Cursor posted a security notice about the tampered Claude Code extension. Versions 2.1.312 and 2.1.313 of anthropic.claude-code were modified and served from its VS Code Extension Marketplace.

The bad builds were live from about 2:27am to 1:35pm Pacific time. For teams in India, that is roughly 2:57pm on October 29 to 2:05am on October 30 IST. Cursor says Anthropic did not build these versions.

Here is the short timeline from the official posts:

Oct 29: Cursor finds the tampered versions, pulls them and shuts the whole marketplace down as a precaution.
Same day: Cursor audits access, finds no other tampered extensions, rotates its keys and rebuilds the marketplace.
Oct 30: Cursor updates its indicators and Microsoft publishes a deep technical breakdown.
After that: Anthropic pushes its real extension straight to version 2.1.314 to avoid confusion, as SecurityWeek reported.

Cursor also worked with the hosting provider to take the attacker's server offline. So the tunnel and data upload no longer work. But files already written to a laptop stay there until someone removes them.

How the Fake Claude Code Extension Worked

The trick was simple. Someone injected a JavaScript function at the top of the extension's main file. It ran the moment the extension loaded, before any normal code. The user did not need to click anything.

According to the Microsoft Threat Intelligence analysis, the loader did five things in order:

Collected host details: hostname, username, OS, home folder, working folder, Git email and public IP.
Looked for secret names: it listed up to 40 environment variable names containing words like KEY, TOKEN, SECRET, PASS, AWS or GCP. It sent the names, not the values.
Added an SSH key: it appended an attacker key labeled svc-telemetry to the user's authorized_keys file.
Opened a reverse tunnel: it tried to connect out to the attacker's server and forward traffic back to the laptop's SSH port.
Set up persistence: it wrote startup scripts so the tunnel would retry every 60 seconds, even after a restart.

Microsoft diagram of the five step attack chain used by the malicious Claude Code branded extension — The five-step attack chain behind the fake Claude Code extension. Image credit: Microsoft Threat Intelligence, Microsoft Security Blog.

The persistence names were chosen to look harmless. On macOS it used a LaunchAgent called com.apple.sysmond. On Windows it tried a scheduled task called SysMon, with a Startup folder fallback.

The extension kept working normally the whole time. That is what makes this kind of attack so hard to spot from the editor alone.

Why most backdoors probably failed

There is some good news. Turning on the local SSH service needs admin rights. Cursor says the extension did not have them on most Mac and Windows machines, and bugs in the code also got in the way.

On those machines, the attacker could not log in through the tunnel. But the key, the startup scripts and the host report still went through. So every exposed machine still needs cleanup, even if no one got in.

Terminal style SSH command showing reverse forwarding to port 22 used by the fake extension — The reverse SSH forwarding command the loader tried to run, with key path redacted. Image credit: Microsoft Threat Intelligence, Microsoft Security Blog.

Who Was Exposed by This Supply Chain Attack

The risk is narrow but real. You are in scope only if all of these are true:

You used Cursor on Windows or macOS.
You installed or auto-updated the Claude Code extension from the Cursor marketplace.
That happened inside the October 29 window listed above.

Microsoft confirmed the bad packages never reached the Visual Studio Marketplace or the npm package @anthropic-ai/claude-code. Anthropic told Microsoft its own systems were not compromised.

How many people does that cover? SecurityWeek reported that security researcher Kevin Beaumont estimated roughly 5,000 developer systems might have downloaded the bad versions. That is an outside estimate, not an official count from Cursor.

Why AI Coding Tools Are a New Target for Agencies

Most agency teams I work with now run an AI coding assistant inside their editor. Those extensions sit very close to the crown jewels. They see the repo, the terminal and often the cloud keys loaded on a dev laptop.

That makes the extension marketplace part of your software supply chain. It is the same idea as a poisoned npm package, just one layer up.

Think about a typical agency in Bengaluru or Austin. One developer laptop may hold:

SSH keys for three or four client servers
Git access to private client repos
Cloud credentials in a .env file or shell profile
Saved sessions for staging dashboards and CI tools

A single backdoored laptop can turn into a breach notice for several clients. That is the real cost here, and it is why I treat editor extensions like any other dependency.

We covered a related risk recently in our post on AI agent security and human approval bypass. The pattern is the same. AI tools get wide access, so a small slip has a big blast radius.

How to Check Your Machines Today

Cursor published quick checks that look for the attacker key. Run them on every Mac and Windows machine that uses Cursor.

On macOS

Open Terminal and run:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows

Open PowerShell and run Cursor's script from the notice. It checks both %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for the same marker.

If the key shows up, the machine is impacted. Microsoft also suggests a no-result check is not proof by itself. Look at install records and network logs too.

Other signs worth searching for across your fleet:

Connections to the attacker IP 134.209.82.225
Files named .smt, .smtk, smt.cmd or sysmon.cmd
Temp files starting with .stk_
A LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist
A scheduled task named SysMon that points to smt.cmd

Cleanup Steps After a Supply Chain Attack Hit

If you find a hit, don't just uninstall the extension. Both Cursor and Microsoft warn that uninstalling may not be enough, because the payload writes files outside the extension folder.

Here is the order I'd follow, based on their guidance:

Isolate the laptop from the network so the tunnel can't retry.
Save evidence first. Keep a copy of the extension package, the changed key file and the startup items.
Remove the bad key labeled svc-telemetry. Leave your real keys alone.
Delete the persistence items and stop any running tunnel processes. Cursor offers remediation scripts for macOS and Windows.
Rotate credentials from a clean device. Think SSH keys, Git tokens, cloud keys and saved sessions.
Decide on a rebuild. If you can't trust the machine, wipe it.
Tell affected clients if their keys or repos were reachable from that laptop.

Step 7 matters a lot for agencies. Many client contracts in the USA and India now ask vendors to report security incidents quickly. Check yours before you need it.

Controls That Stop the Next Fake Extension

Cleanup fixes this incident. Policy stops the next one. Microsoft points teams to Cursor's own hardening options, and I'd add a few basics.

Approved publishers only. Cursor lets admins restrict extensions to a list of trusted publishers.
Install cooldown. Delay new extension versions by a few days. Most bad releases get caught fast, as this one was.
No admin rights for daily work. This incident shows why. Lack of admin rights blocked the worst step on most machines.
Secrets out of env vars. Use a secrets manager or short-lived tokens instead of keys sitting in shell profiles.
Endpoint monitoring. Alert on new SSH keys and new startup items on dev machines.
An extension inventory. Know which extensions and versions each developer runs.

If you want a formal base for this, the NIST Secure Software Development Framework is a good, free starting point. It covers protecting the tools and environments you use to build software, not just the code you ship.

A quick policy table for small agencies

Team size	Minimum control	Nice to have
1 to 10 devs	Approved extension list, no admin rights	Weekly key check script
10 to 50 devs	Install cooldown, secrets manager	Endpoint alerts on SSH changes
50+ devs	Central extension policy, incident runbook	Full EDR with hunting queries

What This Means for Clients Buying AI-Built Software

Clients are starting to ask how agencies use AI tools. After this week, expect sharper questions. Which extensions do your developers run? Who approves them? How fast can you rotate keys?

Have short, honest answers ready. A one-page note on your AI tool policy can win trust in a pitch. It also helps when a client's security team sends a long vendor questionnaire.

If you need help setting up safer dev workflows, our software development consulting team works with agencies on exactly this. You can also browse more AI and software security guides on our blog.

Key Takeaways

What: a supply chain attack used fake Claude Code extension versions 2.1.312 and 2.1.313 on the Cursor marketplace.
When: October 29, 2026, for about 11 hours.
Impact: attacker SSH key, startup scripts and a host report. Remote login mostly failed without admin rights.
Check: search authorized_keys for svc-telemetry and scan for the listed files.
Fix: isolate, remove artifacts, rotate credentials from a clean device.
Prevent: approved publishers, install cooldowns and no daily admin rights.

About the Author

Nitin Kumar is the Lead Project Coordinator at Debugged Pro. He helps agencies and product teams in India and the USA plan, ship and secure software projects. His focus is practical AI adoption and clean delivery.