ACN flags malicious Claude Code versions available on Cursor for 11 hours

Italy’s Agenzia per la Cybersicurezza Nazionale (ACN) issued CSIRT Italia bulletin BL01/261104/CSIRT-ITA on 4 November 2026 after Cursor identified a marketplace incident on 29 October. Malicious versions 2.1.312 and 2.1.313 of the `Anthropic.claude-code` extension were available through the Cursor VS Code Extension Marketplace for approximately 11 hours, from 09:27 to 20:35 UTC. The bulletin rates the incident High, with a score of 70.0.

The affected packages targeted Windows `win32-x64` and macOS `darwin-arm64` development environments. ACN says organisations should check logs, network telemetry and developer workstations for installations or updates during the exposure window, including connections to `134[.]209[.]82[.]225` on TCP ports 22 and 8099. Evidence of execution should trigger endpoint isolation, credential and key rotation from a trusted device, and review of production and CI/CD access.

What the payload did

The malicious code was inserted into `extension.js` and ran when the IDE started. It collected the hostname, username, operating system, architecture, home-directory path, environment-variable names, working directories, Git-configured email address and public IP address. It sent the information by HTTP POST to `134[.]209[.]82[.]225:8099/beacon`.

The code also attempted to add an attacker-controlled SSH public key, identified by the comment `svc-telemetry` and fingerprint `SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk`, to local `authorized_keys` files. It attempted to enable the SSH service and establish a reverse tunnel to `tunnel@134[.]209[.]82[.]225` over TCP port 22.

Persistence mechanisms included the macOS LaunchAgent `~/Library/LaunchAgents/com.apple.sysmond.plist` and hidden scripts under `~/.config/.smt`. On Windows, the payload created a scheduled task named `SysMon`, configured to attempt execution with SYSTEM privileges, and a startup script named `sysmon.cmd`.

ACN says enabling the SSH daemon required administrative privileges that the IDE generally did not have. Programming errors therefore caused the SSH service activation to fail on most standard hosts, unless the IDE had been launched with elevated privileges. That reduced the likelihood of interactive remote access, but did not prevent metadata theft or installation of the unauthorised key and persistence files.

The compromise was distributed only through Cursor’s marketplace. ACN says there is currently no evidence that Anthropic’s official distribution or other packages hosted on Cursor were compromised.

Containment and follow-up

Cursor said it removed the versions, temporarily suspended the catalogue to check other extensions, rotated its cryptographic keys, rebuilt the marketplace infrastructure and worked with its hosting provider to disable the attacker’s command-and-control server.

ACN warns that removing the extension alone is insufficient because standalone scripts may remain. Organisations should check the relevant `authorized_keys` files, remove the key and persistence mechanisms, terminate `ssh` or `autossh` tunnel processes, and consider rebuilding affected hosts. The bulletin also recommends disabling automatic IDE extension updates, applying least-privilege controls, avoiding IDE execution with administrator rights and segregating production keys and CI/CD tokens.

The ACN also issued a 6 November alert on a high-severity Codex Desktop vulnerability, urging users to apply the vendor’s security updates. At the time of the Claude Code bulletin, Cursor’s attacker-controlled server had been disabled, but ACN says that does not remove persistence mechanisms already installed on previously exposed systems.