A backdoored Claude Code extension sat in Cursor's marketplace for about 11 hours. Audit what auto-updates on your build machines

A trusted extension turned hostile through its official update channel, and the first thing it went looking for was your keys.

What happened

On Thursday, a tampered version of Anthropic's Claude Code extension, version 2.1.313, was published to the VS Code extension marketplace inside Cursor. Cursor says it reached at most 5,000 users. Researchers quoted by Ars Technica say it was distributed through Anthropic's official account on Cursor, and The Decoder reports that Anthropic had no involvement in building it. Neither company has explained how the account was taken over.

According to Cursor, as reported by Ars, the extension collected the hostname, username, OS, public IP, configured Git email and the names of environment variables. It also tried to add an attacker SSH key, open a reverse SSH tunnel and keep it running after reboot. Bugs in the code and missing admin rights meant the tunnel step would fail on most machines, but the reconnaissance still reported back. Security firm Phorion said the variable names let the operator take inventory of which cloud credentials and API tokens sat on each machine.

Cursor pulled the version, took the whole marketplace offline to rotate keys and audit access, and has since reopened it. Anyone who installed or updated the extension from Cursor between 5:27 am and 4:35 pm ET on Thursday should treat that machine as affected.

My take

This is the part of automation work nobody puts in a proposal. The laptop that builds a client's n8n flows, Zapier webhooks and CRM scripts often holds the keys to all of them. Even the variable names are a map.

What I do on build machines:

1. Turn off auto-update for editor extensions and update on purpose, a few days after a release lands.
2. Keep production keys out of shell profiles and local .env files. Use a secrets manager and scoped keys per client.
3. Keep a written list of every key that touches a client system, so a rotation takes an hour instead of a weekend.

If you were in that window, rotate first and investigate second, using the indicators of compromise Cursor and Phorion published.

I build client automations with scoped keys and a rotation plan from day one. More at romielwillautomate.dev.