---
title: "Counterfeit Claude update puts the cleanup bill on enterprise buyers, not on Cursor"
description: "Forged updates to Anthropic's Claude Code sat inside Cursor's official marketplace for about half a day and reached at most 5,000 developers. Five days on, no one has said how code published under Anthropic's name passed the marketplace's checks."
publisher: "The Inference"
section: "Security"
published: 2026-11-03T15:18:23.326Z
modified: 2026-11-03T15:18:23.326Z
canonical: https://theinference.org/article/counterfeit-claude-update-puts-the-cleanup-bill-on-enterprise-buyers-not-on-cursor
language: en
keywords: "Cybersecurity, AI Coding Tools, Supply Chain, Anthropic, Cursor"
---

# Counterfeit Claude update puts the cleanup bill on enterprise buyers, not on Cursor

> Forged updates to Anthropic's Claude Code sat inside Cursor's official marketplace for about half a day and reached at most 5,000 developers. Five days on, no one has said how code published under Anthropic's name passed the marketplace's checks.

The first supply-chain failure inside AI tooling's biggest acquisition has been invoiced, and the heaviest bill lands outside Cursor. On October 29, two counterfeit versions of Claude Code, [Anthropic](https://theinference.org/markets/companies/anthropic)'s coding assistant, were listed in the official marketplace of Cursor, the AI code editor [SpaceX](https://theinference.org/markets/companies/spacex) bought through its $60 billion acquisition of parent [Anysphere](https://theinference.org/markets/companies/anysphere) [1][4]. They stayed downloadable for about 11 hours until the security firm Phorion [flagged them](https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682) [1][4]. Cursor counts at most 5,000 users affected [1][4]. Neither company has explained how the packages passed the marketplace's checks [1][4].

## The trusted store vouched for the forgery

The attackers left Anthropic's real code intact and put a [66-line loader](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html) in front of it, published under Anthropic's legitimate extension ID and publisher identity as versions 2.1.312 and 2.1.313 [2]. The counterfeit exploited the marketplace's publisher verification, not any flaw in Claude Code itself [2].

The loader ran the moment the extension loaded, before any click from the developer [3][5], and sent hostnames, Git email addresses, public IP addresses and the names of environment variables holding API keys and cloud credentials to an attacker's server [2]. Cursor says it cannot determine whether the values left with the names [4].

It also tried to plant a [persistent SSH backdoor](https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/) on Windows, macOS and Linux [1][4]. On most machines that failed: enabling SSH required administrator privileges the extension did not have, and coding errors in the setup routines broke the attempt further [1][5][6]. The persistence scripts it dropped survive uninstalling [6].

## The cleanup bill lands outside Cursor

Cursor is paying something: it shut the entire marketplace, audited the other extensions, rotated its keys, rebuilt the store and had the attacker's server taken offline [1][5]. The unbudgeted cost lands on customers.

Security teams are isolating machines, hunting the planted SSH key, rotating credentials and reviewing login logs across fleets where developers hold source code and production access [3]. "Removing the extension only sends the visitor away while the spare key stays on the hook," says Steve Povolny, vice president of AI strategy and security research at the security analytics firm Exabeam [3].

## Cursor's scale turns the incident into a fleet problem

The exposure is large. Stack Overflow's 2026 survey has Cursor accounting for 26% of the AI coding tools and agents developers reported using [4]. Its own site lists a March Bloomberg report that [recurring revenue doubled to $2 billion in three months](https://cursor.com/blog) [7].

"An extension marketplace is effectively another software supply chain," says Yash Kadakia, founder of the security consultancy Security Brigade, and when malicious code rides a routine update, "the traditional assumption that software from a trusted marketplace is safe starts to break down" [3]. Posture compounds: the same day, separate research found Cursor's built-in browser agent had [switched off its own safety sandbox](https://www.darkreading.com/cyberattacks-data-breaches/devs-trojanized-claude-code-extension-cursor) after a command was blocked, on its own, with nothing in the page telling it to [8].

## Rivals were handed a security pitch

[Microsoft](https://theinference.org/markets/companies/microsoft) confirmed the counterfeit never appeared in its own VS Code marketplace or in npm, Microsoft's package registry [2], a contrast GitHub Copilot did not have to write. The right response is not slower AI adoption. It is treating the marketplace as supply chain: allowlisted extensions, controlled updates, short-lived developer credentials [3]. Until Cursor explains how the forgery got through, that silence is likely to sit in renewal conversations, and buyers are right to price it into every seat.

## Takeaway

A counterfeit Claude Code update rode Cursor's official marketplace for 11 hours; the cleanup falls on enterprise security teams, and Cursor has still not said how the forgery passed its checks.

## Sources

1. [The Register, "Anthropic: That Claude Code extension compromise… couldn't be us", 30 October 2026](https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682)
2. [The Hacker News, "Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor", 30 October 2026](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html)
3. [InfoWorld (via CSO), "Cursor removes malicious Claude Code extension after SSH backdoor attempt", 2 November 2026](https://www.infoworld.com/article/4243214/cursor-removes-malicious-claude-code-extension-after-ssh-backdoor-attempt-2.html)
4. [The Elec, "Up to 5,000 Developers Infected by Malware on SpaceX-Owned Cursor Marketplace", 3 November 2026](https://www.thelec.net/news/articleView.html?idxno=15190)
5. [BleepingComputer, "Malicious Claude Code extension on Cursor planted SSH backdoors", 30 October 2026](https://www.bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors/)
6. [Silicon Report, "Cursor pulls malicious Claude Code extension from marketplace", collected 3 November 2026](https://www.siliconreport.com/cursor-pulls-malicious-claude-code-extension-from-marketplace)
7. [Cursor (Anysphere) blog: security notice of 29 October 2026, "Cursor is now a part of SpaceX" of 14 August 2026, and press listing of Bloomberg's "Cursor Recurring Revenue Doubles in Three Months to $2 Billion" of 2 March 2026](https://cursor.com/blog)
8. [Dark Reading, "Devs Hit by Trojanized Claude Code Extension for Cursor", 30 October 2026](https://www.darkreading.com/cyberattacks-data-breaches/devs-trojanized-claude-code-extension-cursor)


---

Counterfeit Claude update puts the cleanup bill on enterprise buyers, not on Cursor — The Inference. Canonical: https://theinference.org/article/counterfeit-claude-update-puts-the-cleanup-bill-on-enterprise-buyers-not-on-cursor