The compromised versions attempted to plant SSH keys and establish persistent remote access; Anthropic says an attacker used access to Cursor’s marketplace to publish the tampered extension.