Cursor pulls Claude Code 2.1.312/2.1.313 over malicious code

The incident centers on a tampered build appearing inside Cursor's marketplace, rather than a compromise of Anthropic's own systems or employee machines. According to Phorion's analysis, the attackers inserted malicious code at the start of the extension's extension.js file, so the harmful routine began as soon as the extension loaded. The code sought to add an attacker-controlled public key to the authorized_keys file and set up a reverse SSH tunnel, with persistence mechanisms spanning macOS LaunchAgent, Linux cron, and Windows Task Scheduler. On many macOS and Windows environments the code failed to enable the SSH service due to insufficient administrator rights, Cursor said, but the attacker key addition, auto-start configuration, and PC data transmission still executed. Cursor has removed the extension, paused the marketplace for investigation, and shut down the attacker's server, while publishing verification steps and repair scripts for affected users.