The bad versions were pulled at 2:35 p.m. Calgary time, the same day they appeared. A team-wide install delay of one day would have kept them off every machine that honoured it.
A malicious Claude Code extension sat in Cursor’s extension marketplace for about 11 hours on October 29, 2026, so any install delay longer than that would have kept it off a developer’s laptop. Cursor’s team setting for that delay, the Marketplace Install Cooldown, ships at 0 hours, which means off. For a Canadian software shop, agency or in-house dev team using Cursor, that default is the part worth changing this week.
The window ran from about 2:27 a.m. to 1:35 p.m. Pacific time, which is 3:27 a.m. to 2:35 p.m. in Calgary and 5:27 a.m. to 4:35 p.m. in Toronto. For a Toronto team that starts at 9 a.m., that window covered most of the working day.
How the malicious Claude Code extension worked
It ran attacker code the moment the extension loaded. According to Cursor’s security notice, the code collected host details, added an attacker’s SSH key to the machine’s list of trusted keys, tried to switch on the local SSH service and open a reverse tunnel, and set itself up to retry about every 60 seconds.
Think of it as a stranger adding their own key to your front-door lock and leaving a note to try the door every minute. The host report went out right away: hostname, username, operating system, home folder path, the names of environment variables, working folders, the configured Git email and the public IP address. Names, not values, for those environment variables, which is a real limit on what leaked in that first step.
The tunnel is where it mostly broke. Cursor says turning on the SSH service needs administrator rights, which the extension does not have on most macOS and Windows machines, so on those hosts the attacker could not log in. Microsoft’s threat intelligence write-up makes the same point with a caveat we would keep in mind: the loader “may still write keys and persistence artifacts even when tunnel access fails.”
Microsoft also confirmed the tampered packages never appeared in Microsoft’s own Visual Studio Marketplace or on npm, and that Anthropic told Microsoft its systems were not compromised. On the evidence so far, this was a problem in one distribution channel, not in Claude Code itself. That distinction matters for your vendor file, and it does not make the cleanup any shorter.
Why uninstalling is not the fix
Removing the malicious Claude Code extension leaves the planted pieces behind. Cursor warns that the payload drops standalone persistence scripts that keep running, so a machine that received version 2.1.312 or 2.1.313 needs the attacker’s key removed, the startup task or launch agent deleted, and its credentials rotated from a different, trusted computer.
The credential step is the one teams skip. A developer laptop usually holds Git tokens, cloud keys and AI provider keys, and we covered how far one leaked key can travel in our guide to AI API key security. Cursor’s own wording is careful here: the limited collection of variable names “does not rule out later credential access over the backdoor.”
Where the PIPEDA question starts
It starts when an affected laptop could reach personal information your company controls, such as a customer database, a support inbox export or a staging copy of production data. At that point you are assessing a possible breach of security safeguards under PIPEDA, and the record-keeping duty applies whichever way the assessment goes. Firms in Alberta, British Columbia and Quebec answer first to their own provincial private-sector privacy laws for activity inside the province, so confirm which law applies before you write anything down.
The Privacy Commissioner’s guidance on breach reporting is plain about it: report to the commissioner and notify people when there is a real risk of significant harm, and keep a record of every breach for two years regardless. Small businesses are included. A one-paragraph note saying a machine was checked, nothing personal was reachable and the keys were rotated is cheap to write now and hard to reconstruct later.
The host report itself sent a developer’s username and Git email to an unknown party. Whether that alone counts as a breach depends on your province and sector, because staff information is treated differently across Canada’s private-sector privacy laws. That is a question for counsel, not for us.
Three settings that would have changed the outcome
Cursor documents three controls for teams, and each one has to be switched on by someone. The install cooldown is the one that maps directly onto this incident, because the bad versions were pulled after about 11 hours.
| Control | What it does |
|---|---|
| Install cooldown | Cursor calls it Marketplace Install Cooldown. Holds installs and updates until a version has been public for a set number of hours. Default 0. Set by team owners and admins; overrides each user’s own setting. |
| Allowed extensions | Limits installs to approved publishers or extension IDs, from the team dashboard or device management. |
| Signature check | Enterprise teams can require a valid Open VSX signature before an extension installs. |
The Cursor extension documentation calls the cooldown “a buffer against short-lived malicious uploads”, which is exactly what this was. The trade-off is real: a 24-hour delay also holds back genuine security fixes for a day. For most teams outside a live incident, that is a fair price. If you are still choosing a plan, the team controls are one more line to weigh beside the costs in our Cursor pricing comparison for teams.
What Cursor’s notice cannot tell you
Cursor’s notice, as we read it on October 31, gives no count of affected machines and no Canadian figure. We did not run the malicious package or Cursor’s check script ourselves. The claim that the tunnel failed on most machines is Cursor’s analysis, supported by Microsoft’s reading of the code, and we have no independent test of it.
So treat “most hosts were safe” as the vendor’s best estimate for the average machine, not a finding about yours. A developer who starts Cursor with administrator rights is the exception Cursor itself names. Access through a trusted supplier’s channel is also the weak point we traced in the Mythos contractor login story.
One afternoon, every Cursor machine
Give one person an afternoon and a list. The inputs are every computer with Cursor installed and each one’s extension history for October 29. The pass mark is zero machines with the attacker’s key labelled svc-telemetry in the trusted SSH keys file, the team cooldown set to at least 24 hours, and a written note for your breach log either way.
For a 12-person Halifax web agency, as an illustration, that is a few minutes per laptop with Cursor’s check script, plus a quick change in team settings. If any machine fails, isolate it, follow Cursor’s cleanup steps and rotate its credentials from another computer before anyone opens it again. More reviews of the tools Canadian teams rely on sit in our AI tools for Canadian businesses hub.
FAQ
Which versions of the malicious Claude Code extension were served?
Versions 2.1.312 and 2.1.313 for Windows and macOS, served in Cursor’s extension marketplace between about 2:27 a.m. and 1:35 p.m. Pacific time on October 29, 2026. Cursor says these versions were not developed by Anthropic.
Was the Claude Code extension on the Visual Studio Marketplace affected?
No. Microsoft says the tampered packages were never published or distributed from its Visual Studio Marketplace or from npm, and that the evidence points to the Cursor marketplace only.
Does uninstalling the malicious Claude Code extension remove the backdoor?
Not necessarily. Cursor warns the payload drops standalone persistence scripts that keep running. Remove the attacker’s SSH key and the startup task or launch agent, then rotate credentials from a different, trusted computer.
How do I check whether a machine was affected?
Look for an SSH key labelled svc-telemetry in the machine’s trusted keys file, or run the check script in Cursor’s security notice. Any machine that installed or updated to 2.1.312 or 2.1.313 in the window should be checked.
Do Canadian businesses have to report the incident?
Only if it led to a breach involving personal information that poses a real risk of significant harm. Under PIPEDA, though, every breach must be recorded and the record kept for two years. Alberta, British Columbia and Quebec have their own private-sector laws.
The setting takes less time to change than this column took to read. The evidence that would settle the bigger question, how many machines actually ran the tunnel, has to come from Cursor, and until it does, the one-day cooldown is the cheapest insurance on offer.
Facts in this column were checked on October 31, 2026 against Cursor’s October 29 security notice and extension documentation, Microsoft’s October 30 threat intelligence post and the Privacy Commissioner of Canada’s breach guidance. We did not test the malicious extension.
