Microsoft Security Research published an analysis on 30 October of two tampered builds of a Claude Code-branded extension, versions 2.1.312 and 2.1.313, that were served from the Cursor extension marketplace on 29 October between roughly 02:27 and 13:35 Pacific time. About 11 hours. Cursor puts the number of users potentially affected at at most 5,000. The clean version is 2.1.314.

Several outlets ran this as Anthropic being hacked. That is not what the evidence says, and the correction is worth making first because it changes what readers should do about it.

Microsoft's sentence: "Anthropic confirmed to Microsoft that their systems were not compromised." Anthropic says it did not develop the package. Microsoft adds that the malicious packages were never published or distributed from the Visual Studio Marketplace or from the npm package, and that "all evidence suggests that the incident is limited to Cursor marketplace."

So: one marketplace, one window, two builds. Not a vendor breach.

What the loader does

An injected function runs when the extension module loads, before the extension itself starts.

It collects hostname, username, operating system, architecture, home directory, working directory and the global Git email. It then lists up to 40 environment variable names containing strings like KEY, TOKEN, SECRET, PASS, AWS or GCP.

That is names only, not values, and it is the second thing the coverage keeps getting wrong. The beacon reports that a variable called AWS_SECRET_ACCESS_KEY exists. It does not report what is in it.

Next it looks in the authorized keys file for the comment svc-telemetry. If the marker is absent it appends an embedded Ed25519 public key. It decodes a separate private key into a hidden temporary file whose name is .stk_ followed by ten hex characters derived from the hostname and home directory, tries to enable the local SSH service, and opens a reverse tunnel back to the attacker, forwarding a server-assigned remote port to port 22 of the workstation. Host key checking is disabled, the known hosts file is bypassed, prompts are suppressed. On Unix-like systems it prefers autossh and falls back to ssh; on Windows it runs a hidden PowerShell loop. After the tunnel exits it waits 60 seconds and tries again.

The whole chain downloads no executable. Everything is either embedded in the package or already on the machine.

It pretends to be monitoring software throughout

The persistence is the tell, and it is the same lie on every platform.

On macOS it writes a user LaunchAgent called com.apple.sysmond.plist, with run-at-load and keep-alive set. On Linux it adds a reboot entry to the user crontab. On Windows it creates a scheduled task called SysMon that asks to run as SYSTEM, with a batch file in the Startup folder as a fallback. The supporting files are named .smt and .smtk, which read as telemetry abbreviations at a glance.

The key comment is svc-telemetry. The task is SysMon. The plist is named after a real Apple daemon. Somebody thought carefully about what an administrator's eye slides over.

The callback goes to 134.209.82.225 on port 8099.

And then it largely did not work

This is the part that will not make the headlines, and it is the most useful thing in the report.

Cursor reports that errors and administrator permission requirements blocked SSH access on most macOS and Windows hosts. Microsoft writes: "A running SSH process does not necessarily mean the attacker gained access."

A reverse tunnel needs the local SSH service running and reachable, and on a developer laptop it usually is not. The loader asked for SYSTEM on Windows and for service control on macOS, and in most cases the operating system said no.

Microsoft is also explicit about what it cannot confirm: how many hosts were affected, whether the persistence mechanisms actually executed, whether any secret was stolen, whether the attacker's server accepts tunnel connections in practice, and who did any of it.

What to do

  • Update the extension to 2.1.314 or later, and check your install history for 2.1.312 and 2.1.313. Cursor has published a detection script and says it will contact affected users.
  • Grep every developer machine's authorized keys file for the comment svc-telemetry. That one string is the cheapest check here.
  • Look for a scheduled task called SysMon that is not Sysinternals Sysmon, a LaunchAgent named com.apple.sysmond.plist, and reboot entries in user crontabs.
  • Treat an SSH service that is suddenly enabled on a laptop as an incident, not a configuration drift.
  • Rotate anything a machine held if you find the marker. The beacon took names, but a working tunnel would not have stopped there.
  • Do not generalise this to the official channels. The npm package and the Visual Studio Marketplace were not involved.

What is not established

  • How the tampered build reached the marketplace. Neither Cursor nor Microsoft has said. One analysis suggests stolen publisher credentials, which is unconfirmed.
  • Who is behind it. Microsoft says its mappings do not establish attribution.
  • How many machines ran the code, or how many tunnels connected.
  • Whether any credential was actually stolen. The beacon sends names, and theft is not demonstrated.
  • Whether the persistence executed anywhere. Microsoft says an artefact alone does not prove it ran.