On October 29, 2026, between about 2:27am and 1:35pm PT, Cursor’s own VS Code extension marketplace served tampered versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for macOS and Windows. Anthropic did not build them. They try to plant an SSH backdoor. To check, search your SSH authorized_keys file for a key labeled svc-telemetry. If it is there, you were hit. Uninstalling the extension is not enough: run Cursor’s remediation script and rotate your credentials from a clean machine.
What happened
According to Cursor’s security notice, a modified copy of Anthropic’s Claude Code extension was live in the Cursor VS Code Extension Marketplace for roughly 11 hours on October 29. Only versions 2.1.312 and 2.1.313 for Windows and macOS were affected, and Cursor says other extensions from its marketplace were not.
When the extension loads, the injected code tries to:
- add an attacker SSH key labeled svc-telemetry to your authorized_keys file
- turn on the local SSH service and open a reverse SSH tunnel to an attacker server
- make that tunnel come back after a restart (a LaunchAgent on macOS, a scheduled task called SysMon or a Startup script on Windows), retrying about every 60 seconds
- send host details: hostname, username, OS, home folder, Git email, public IP, and the names (not the values) of environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP (Microsoft Security Blog)
Turning on SSH needs admin rights the extension lacks on most Macs and PCs, so the attacker usually could not log in. The key, startup files and host report still happened. The attacker server is now offline, but that does not clean your machine.
Am I affected? Check in 30 seconds
1. Did you install or update Claude Code in Cursor on October 29? Auto-update counts. Check the Claude Code version in Cursor’s Extensions panel. If you got 2.1.312 or 2.1.313 in that window, do every step below.
2. On macOS, run this in Terminal:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
3. On Windows, run this in PowerShell:
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }
If you see “No key found”, Cursor treats the machine as not impacted. If you see “svc-telemetry key found”, keep going.
I found the key: what to do now
4. Isolate and run Cursor’s cleanup script. Take the machine off work networks and VPNs first. Then download the script for your system from the remediation section of Cursor’s notice and run it from the folder you saved it to:
- macOS, as your normal user (not root):
bash remediate-macos.sh - Windows, from PowerShell opened with Run as Administrator:
powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1
The scripts exit with an error if anything is left.
5. Check the leftovers yourself. These should be gone:
- macOS:
~/Library/LaunchAgents/com.apple.sysmond.plist,~/.config/.smt,~/.config/.smtk - Windows: the scheduled task
SysMon,%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd,%USERPROFILE%\.config\smt.cmdand%USERPROFILE%\.config\smtk - Both: temp files named
.stk_followed by 10 hex characters
6. Rotate credentials from a different, trusted machine. API keys, cloud accounts, GitHub tokens, SSH keys and sessions. Only variable names were sent, but Cursor notes that does not rule out later access through the backdoor. Our env var checker helps you list what to rotate.
7. Decide whether to rebuild the machine. Cursor and Microsoft both say to assess this.
Why uninstalling is not enough
The startup files live outside the extension folder. Removing or updating Claude Code deletes the extension, but the LaunchAgent, scheduled task and scripts in ~/.config keep running and retrying the tunnel.
Is Claude Code safe to use in Cursor now?
Cursor says it removed the bad versions, rebuilt its marketplace, rotated its keys and found no other tampered extensions. The Hacker News reported on October 30 that Anthropic’s latest version is 2.1.314. Update to it. Microsoft also recommends Cursor’s hardening controls: allow only approved publishers and set an extension install cooldown. See our Claude Code and Cursor guides, and our package check for supply chain hygiene.
FAQ
Was the Claude Code extension in Cursor hacked?
Yes, but only the copy in Cursor’s own marketplace, on October 29, 2026, from about 2:27am to 1:35pm PT. Anthropic did not build it and says its systems were not compromised.
Which Claude Code versions were malicious?
Anthropic.claude-code 2.1.312 and 2.1.313, downloaded from the Cursor VS Code Extension Marketplace on macOS or Windows.
How do I check if I installed the malicious version?
Search your SSH authorized_keys file for a key labeled svc-telemetry with the commands above. If it is there, your machine is impacted.
Is uninstalling the extension enough?
No. Startup files outside the extension folder keep running. Run Cursor’s remediation script and rotate credentials from another machine.
Is it safe to use the Claude Code extension in Cursor now?
Cursor removed the bad versions and rebuilt its marketplace. Update to the latest official version (2.1.314 as of October 30, per The Hacker News).
Were VS Code Marketplace, Open VSX or npm users affected?
Microsoft says the malicious versions were never published on the Visual Studio Marketplace or in the npm package @anthropic-ai/claude-code. The Hacker News reports no evidence that they reached Open VSX. Cursor told The Hacker News that at most 5,000 users were affected and that it will contact them directly.
Sources (checked November 2, 2026): Cursor security notice (October 29, 2026, updated October 30), Microsoft Security Blog (October 30, 2026), The Hacker News (October 30, 2026).
Comments
Sign in to join the conversation.
No comments yet — be the first.