Tainted Claude Code build stayed in Cursor, Microsoft finds

Microsoft Threat Intelligence says the malicious Claude Code builds 2.1.312 and 2.1.313 never reached Microsoft’s Visual Studio Marketplace or npm, and all evidence suggests the incident is limited to Cursor’s marketplace. Anthropic confirmed to Microsoft that its systems weren’t compromised and it didn’t build the package.

Cursor says the builds were live from about 2:27 AM to 1:35 PM PDT on October 29, 2026. The injected loader looks for environment variables with names like TOKEN or SECRET, but it sends only the names, not the values.

Removing or updating the extension leaves behind what it wrote outside its folder: an SSH key labeled svc-telemetry, tunnel keys, scripts and startup entries named SysMon or com.apple.sysmond.