The Cursor Extension That Quietly Opened a Door to 5,000 Developers

Emily Davis · 2026-10-30

Picture this: you install an extension you trust, get back to work, and never think about it again. That's exactly the kind of blind spot attackers count on. On October 29, a malicious version of Anthropic's Claude Code extension slipped into Cursor's extension marketplace and sat there for roughly 11 hours. In that window, up to 5,000 developers may have downloaded it. What it carried wasn't a nuisance. It was malware built to plant persistent SSH backdoors. ### What Actually Happened Someone managed to push a tampered build of the Claude Code VS Code extension through Cursor's marketplace. It looked legitimate. It behaved like the real thing, at least on the surface. Underneath, it was quietly setting up SSH access that would let an attacker slip back into a machine long after the extension was gone. Eleven hours doesn't sound like much. But think about how fast developers install tools when they're mid-project and trusting a familiar name. A few clicks, a restart, and the damage is done before anyone raises a flag. ### Why This Should Get Your Attention This isn't really a story about one bad extension. It's a story about supply chain trust. When you install a browser extension, a code plugin, or an antidetect browser profile manager, you're handing over a slice of your environment. If that chain gets compromised, everything downstream is exposed. Here's what makes this case especially uncomfortable: - The malicious build reached users through an official marketplace, not a sketchy third-party site. - The payload targeted SSH keys and persistent access, which is exactly what someone needs for long-term intrusion. - The exposure window was short, but 5,000 downloads in 11 hours is a lot of potential victims. > Trust is cheap to give and expensive to lose. In software, the gap between "official" and "safe" keeps getting smaller. ### How Do You Protect Yourself? Start with the basics, but actually do them. Audit what's installed. If you're using Cursor or any code editor with an extension marketplace, go through your list and remove anything you don't recognize or actively use. Check for unexpected SSH keys in your `~/.ssh` directory, especially ones you didn't create. Then think wider. If you run multiple accounts, manage client profiles, or handle sensitive workflows, the same lesson applies to your browser setup. A compromised tool is a compromised identity. That's why so many professionals lean on antidetect browsers with isolated profiles and strict access controls. When one profile gets hit, the rest stay clean. A few habits worth building: - Rotate credentials and SSH keys after any suspected exposure. - Verify extension publishers and check release histories before installing updates. - Isolate high-risk work into separate environments so a single bad download can't spread. - Monitor for unusual outbound connections, especially anything touching port 22. ### The Bigger Picture The Cursor incident is a reminder that the best antidetect browser or the tightest security stack won't save you if the tools you trust turn against you. Security isn't a product you buy once. It's a habit you keep. Check your extensions. Check your keys. And treat every install like it matters, because it does.