On October 29, a maliciously modified Claude Code-branded extension was available in the Cursor extension marketplace for about 11 hours. The affected versions, 2.1.312 and 2.1.313, attempted to install a persistent SSH backdoor on Windows and macOS developer machines. Cursor removed the packages, and Microsoft published a technical analysis on October 30.
The incident was limited to the Cursor marketplace according to the published investigation. Anthropic did not create the malicious extension, and the official Visual Studio Marketplace and npm distributions were not affected. The attack's attempts to enable SSH often failed without administrator privileges; the malware could still leave keys and persistence artifacts behind.
Why this matters
AI coding assistants are becoming normal development tools. Extensions and plugins run near source code, cloud credentials and production access. A compromised extension can execute operating-system commands before an engineer notices anything unusual. Removing the extension alone may leave the workstation exposed.
For a business, the questions are straightforward: which developer AI tools are approved, who can install extensions, and can the security team detect an unexpected SSH key or outbound tunnel?
What to review now
- Identify exposure. Ask engineering which IDEs, AI coding assistants and extension marketplaces they use. Check for the named versions installed or updated from Cursor's marketplace on October 29.
- Investigate affected machines. Preserve evidence; review extension installations, endpoint activity, SSH authorized keys, startup persistence, network connections and access logs. Follow the vendor's platform-specific guidance before cleanup.
- Constrain the supply chain. Use approved-publisher lists, extension installation policies and update delays where supported. Review the trust and permissions granted to extensions and development agents.
- Reduce blast radius. Keep cloud credentials and secrets out of developer workstations where possible. Use short-lived credentials, least privilege, endpoint detection and outbound connection monitoring.
- Make response repeatable. Test whether IT can identify affected developer devices, isolate them, revoke sessions and restore a trusted build environment within hours.
Which technologies help?
Start with existing endpoint management, EDR/XDR, identity, secrets management and developer-platform policies. Software composition analysis, code scanning and artifact provenance help protect the code supply chain, but they do not replace monitoring installed IDE extensions. Where visibility is weak, evaluate developer-environment security, software supply-chain controls and managed detection options against a defined workflow.
Cybersafer helps teams assess the gaps, compare and source suitable technologies, and coordinate implementation with technical partners.
Can your team identify every AI coding extension running on developer devices today?
Sources: Cursor security notice; Microsoft technical analysis.
Discuss this topic → More insights