Malicious Extension Response Lab: Remove the Backdoor
If a tampered AI coding extension ran on your developers’ machines, removing it is only the first step. Cursor says a modified copy of the Claude Code extension, not developed by Anthropic, sat in its marketplace for about 11 hours on 29 October 2026 and tried to install a persistent SSH backdoor. Make 12 scored calls: which hosts ran it, what to preserve, how to remove what an uninstall leaves behind, and which credentials to rotate.
Read the news first in our coverage of the Cursor incident, or check an extension with the Extension Scanner.
You are Jordan Ellis, head of security engineering at Brightfield Payments. A tampered copy of an AI coding assistant extension has been available in an IDE marketplace your developers use. Across 12 decisions you triage which hosts ran it, preserve evidence, remove persistence, rotate credentials and tighten extension trust. The story follows what Cursor says and WIRED reports about the Claude Code extension incident of 29 October 2026; the organisation and its hosts are fictional. No code, commands or indicators appear. Each call is scored 0 to 10 with the source behind the rationale.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
5 points
- A scenario lab with 12 scored decisions about a tampered AI coding assistant extension that reached developers through an IDE marketplace.
- The central lesson: uninstalling the extension is not enough. Cursor says the payload drops standalone persistence scripts that keep running, so you also check for the attacker's SSH key, remove persistence, and rotate credentials the host could reach.
- Follows Cursor's security notice of 29 October 2026 (updated 30 October) and WIRED's report of 30 October. Cursor says the modified versions were not developed by Anthropic; WIRED reports Cursor's figure of at most 5,000 downloads and that a flaw limited the backdoor on most hosts.
- Free to play. A final score, a debrief with the source behind every rationale, and next-step links.
- Defensive only. No code, commands or indicators of compromise appear; read the vendor notice for those. The organisation and hosts in the lab are fictional.
Claimed versus confirmed
Every incident fact in the lab is attributed: “Cursor says” for the vendor’s own account and “WIRED reports” for the press account. The two differ on platforms, and how the tampered package reached the marketplace was unknown when WIRED published. Where a source is silent, the lab says so or keeps the step generic. PlayCISO practice is marked as such.
Frequently asked questions
Was this an Anthropic release?
No, according to the sources. Cursor says the malicious versions of the Claude Code extension "were not developed by Anthropic". WIRED quotes an Anthropic engineer saying it was not a compromise of Anthropic's systems and that the versions on its official channels are not affected. How the tampered copy reached Cursor's marketplace was not public when WIRED published.
How many people were affected?
WIRED reports that Cursor says the extension was downloaded by "at most 5,000 users" over roughly 11 hours on 29 October 2026. That is Cursor's upper bound as reported by WIRED, not a count of compromised machines. Cursor and WIRED both say a flaw in the malicious code limited the backdoor on most hosts.
If I uninstalled the extension, am I safe?
Not necessarily. Cursor says uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts that keep running. Check for the attacker's key and persistence using the vendor's guidance, remove them, and rotate credentials the host could reach.
Why rotate credentials if the attacker's server is offline?
Cursor says it worked with the hosting provider to take the server offline, and still tells affected users to rotate credentials and sessions from a trusted system. The notice says the limited environment variable collection does not rule out later credential access over the backdoor.
Which operating systems were affected?
Cursor's notice names Windows and macOS. WIRED describes the extension as live for Windows, macOS and Linux, and Cursor's indicator list includes Linux file paths. Treat Linux hosts as in scope until you have checked them.
Does the lab contain the malware or its indicators?
No. It contains no code, commands, hashes or addresses. Use the vendor's own notice and remediation scripts for those.
Sources
Opened on 4 November 2026 unless a note says otherwise. Vendor product pages are not used as evidence.
- Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace — Cursor, 29 Oct 2026, updated 30 Oct 2026. Accessed 4 November 2026.
- A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices — WIRED (Lily Hay Newman), 30 Oct 2026. Accessed 4 November 2026.
- LLM03:2025 Supply Chain — OWASP Gen AI Security Project, 2025. Accessed 4 November 2026.
- SP 800-218, Secure Software Development Framework (SSDF) Version 1.1 — NIST, Feb 2022. Accessed 4 November 2026.Only the publication page was read. We cite the framework as a whole (protecting software and verifying release integrity), not individual task numbers.
- Securing the Software Supply Chain: Recommended Practices Guide for Customers — CISA, accessed 4 Nov 2026. Accessed 4 November 2026.CISA returned "Access Denied" to our automated fetch. We list it as further reading only and quote nothing from it.
Scenario people, organisations and hosts are fictional. More tools.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.