The Claude Code name showed up in Cursor's marketplace. The publisher behind the trojan was not Anthropic. For roughly eleven hours on 29 October 2026, that distinction was the whole incident.
Malicious 2.1.312 and 2.1.313 plant SSH keys and persistence
Cursor's security notice says Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS were available on the Cursor VS Code Extension Marketplace between about 2:27am and 1:35pm PT on 29 October 2026. Those builds were not developed by Anthropic.
On load, the injected JavaScript collected hostname, username, OS, architecture, home path, environment-variable names, working directories, configured Git email, and public IP. It attempted to append an attacker-controlled SSH public key with comment svc-telemetry to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel to 134.209.82.225.
Persistence followed: a LaunchAgent labelled com.apple.sysmond on macOS; a SysMon scheduled task with Startup-script fallback on Windows; related hidden scripts under ~/.config and temp paths. Background loops retried the tunnel about every 60 seconds.
Cursor is explicit about failure modes that limited blast radius. Enabling local SSH generally needs administrator rights the extension lacked on most hosts, and errors in the malicious code often blocked the tunnel step. The attacker server was taken offline with the cloud provider, so reverse shell and host-detail POST paths stopped functioning. The loader could still write the SSH key, drop persistence, and stage reconnaissance even when interactive login failed.
Microsoft Threat Intelligence's 30 October analysis matches that chain and adds operational colour: environment-variable name harvest (up to forty KEY/TOKEN/SECRET-shaped names, not values), separate tunnel identity material, and confirmation that Microsoft Visual Studio Marketplace and npm @anthropic-ai/claude-code were never distributing the malicious packages. Anthropic confirmed to Microsoft that its systems were not compromised.
Marketplace trust broke without a publisher compromise
This is an AI-tooling supply-chain story with named versions, a dated window, and a brand impersonation that did not require Anthropic's signing keys. Operators who only watch upstream publisher accounts miss Cursor-marketplace-specific distribution. That is the accountability split: Anthropic-branded trojan, Cursor marketplace access, Anthropic official channels clean.
Microsoft's teardown matters because uninstall guidance alone understates the residue. Persistence and keys live outside the extension folder. Cursor shipped check and remediate scripts for macOS and Windows, published VSIX hashes and IOCs, rotated marketplace keys, and rebuilt the marketplace after a full shutdown. The update on 30 October clarified IOCs and affected versions.
For Frontier readers who live in agent IDEs, the operational stake is immediate. Auto-update paths and brand trust are enough to land a loader. Publisher reputation on another forge does not travel automatically into a third-party marketplace.
Cursor marketplace incident; official Anthropic and VS Marketplace trees clean
Affected artefacts are the Cursor marketplace VSIX builds of anthropic.claude-code 2.1.312 and 2.1.313 (darwin-arm64 and win32-x64 hashes in Cursor's notice). Microsoft states Visual Studio Marketplace and the npm package were unaffected. Cursor reports no evidence that other marketplace extensions were tampered with after audit.
Maturity reading for response tooling: Cursor's remediate-macos.sh and remediate-windows.ps1 are the vendor cleanup path; Microsoft Defender hunting queries are the enterprise detection path. Treat both as usable incident response, then verify with the svc-telemetry key check rather than trusting a single exit code.
Hunt the eleven-hour window, then harden marketplace policy
Security teams should pull extension-install telemetry for anthropic.claude-code 2.1.312 and 2.1.313 on macOS and Windows during the 29 October PT window, run Cursor's impact check for the svc-telemetry key, and isolate hosts with loader or persistence evidence. Remediation means removing the key, LaunchAgent or scheduled task, tunnel scripts, and running processes, then rotating credentials from a trusted machine. Uninstalling the extension is necessary and insufficient.
Platform owners should restrict Cursor extensions to approved publishers where the product allows it, and configure an installation cooldown so newly published versions do not auto-land. Teams that install Claude Code only from Anthropic's official distribution should still verify they never pulled the Cursor marketplace builds during the window.
Ignore panic about Anthropic's own Claude systems being breached. The primaries say otherwise. Do not ignore persistence residue on developer laptops that did install the bad builds.
Uninstall-only cleanup, admin-rights complacency, and brand trust
Assuming "tunnel failed, so we are fine" skips keys and startup scripts that still landed. Assuming administrator rights were required for every harmful step misses reconnaissance POST behaviour and authorised_keys writes. Assuming the Cursor brand default OG or a clean npm tree implies a clean Cursor marketplace confuses distribution channels.
A further failure mode is one-time hunting without policy change. Without publisher allowlists and install cooldowns, the next trojanised familiar name repeats the same eleven-hour shape. Credential rotation delayed until "after we finish remediating" also leaves sessions issued from affected hosts alive too long.
Run the svc-telemetry check before you close the ticket
The durable artefacts are Cursor's dated marketplace window, the 2.1.312/2.1.313 hashes, Microsoft's confirmation that Anthropic and VS Marketplace were clean, and remediation scripts that target persistence outside the VSIX. The Monday move is hunt, remediate, rotate, then lock marketplace policy.