The Pulse

Endpoint Alerts Tied to Tampered Claude Code Extension Appeared on Customer Macs, Reco Says

A tampered Claude Code extension on Cursor’s marketplace reached multiple customer Macs during a window of roughly 11 hours on October 29, 2026, Reco says. No evidence of follow-on SaaS activity has been found to date, the company says, but

AI.info Team · Written with AI · fact-checked · 2026-11-06

Reco published a post on November 5 describing a tampered Claude Code extension that appeared on Cursor’s marketplace. The package was served on October 29 for roughly 11 hours, in versions 2.1.312 and 2.1.313. Anthropic says its own systems were not compromised, and the package was never on the Visual Studio Marketplace or npm.

How the tampered extension kept working

The malicious code ran ahead of the extension’s normal code, allowing the extension to keep working. Microsoft’s analysis, as summarized by Reco, says the loader collected host details such as the machine’s hostname, username, operating system, home directory and global Git email. It also recorded the names—not the values—of environment variables that looked like keys, tokens or secrets.

The loader added an SSH key labelled “svc-telemetry” to the user’s authorized_keys file and tried to enable the local SSH service. It also attempted to open a reverse tunnel to an attacker-controlled server and asked it to forward connections back to the workstation’s SSH port, so no inbound firewall rule was needed. On macOS, it used a LaunchAgent named com.apple.sysmond.plist; on Windows, it created a scheduled task called SysMon.

No evidence of follow-on SaaS activity to date, Reco says

Reco searched for the published attacker IP, persistence files and reverse-SSH command line in endpoint alerts from its customers’ security tools, then checked SaaS environments for the attacker’s IP, new keys or tokens, and unfamiliar sign-ins. The company found the activity as endpoint alerts on individual Macs in multiple customer environments on October 29, inside the exposure window. To date, it says, it has found no evidence of follow-on offensive activity in those SaaS environments.

Microsoft’s analysis shows the foothold, but does not show credentials being stolen from any machine, Reco says. Enabling the local SSH service requires administrator rights, which the extension does not have on most macOS and Windows hosts, Cursor reports. Cursor also worked with the hosting provider to take the attacker’s server offline, it says, but that does not remove anything already on a machine, according to Reco, and the planted key, persistence and beacon do not go away when the extension is removed.

How a developer machine could expose agent access

The SaaS and agent risk is a possible path from the endpoint foothold, not activity shown in the analyzed sample, in Reco’s description. Secrets in plain-text files and environment variables are trivial to read, while secrets in an operating-system keychain or on a hardware key are harder, Reco says. Developer machines typically also hold GitHub tokens, SSH keys, cloud CLI credentials and AI platform API keys, according to Reco.

Machines running coding agents can hold credentials for the agents’ own connections, including API keys, OAuth grants and MCP server configurations, which often embed tokens. Coding agents run shell commands, edit repositories and call tools with the developer’s permissions, Reco says; code running in the same user context inherits that reach. Reco identifies that point as its inference about the position of the malicious code, not something reported for this sample.

Reco’s checks after exposure

Mac and Windows machines that installed or auto-updated the affected extension versions during the October 29 window should be identified, then checked for the planted key, persistence files and scripts, Reco advises. A missing key is not an all-clear, Reco cautions, because the loader swallows errors and persistence can exist without the key. Isolating affected machines, keeping evidence, removing the key, startup entries and scripts separately from the extension, and rotating credentials from a clean device are also recommended in its post.

For follow-up, Reco recommends reviewing SaaS and cloud logs for new SSH keys, deploy keys or personal access tokens, sign-ins or API calls from unfamiliar locations, hosting-provider addresses or devices, new OAuth app grants, new cloud access keys, and bulk repository clones or data exports. Activity by agents run by affected people should be checked as well, it advises. For future extension controls, the company points to approved-publisher or extension-ID restrictions in Cursor and the Marketplace Install Cooldown setting.