Claude Code Extension Backdoor in Cursor: Check and Fix

On October 29, 2026, Cursor's extension marketplace served tampered builds of Anthropic's Claude Code extension that tried to install a persistent SSH backdoor on developer machines. Cursor says the builds were live for about 11 hours and reached at most 5,000 users. If you use Cursor on macOS or Windows and installed or updated the Claude Code extension that day, check for an SSH key named svc-telemetry, because uninstalling the extension does not remove the Claude Code extension backdoor.

Key takeaways

• Modified macOS and Windows builds of Anthropic.claude-code 2.1.312 and 2.1.313 were published in Cursor's own marketplace. Anthropic did not build them (Cursor security notice).
• They were available from about 2:27 a.m. to 1:35 p.m. PT on October 29, 2026.
• Cursor users who installed or updated the extension on macOS or Windows in that window are at risk. Cursor puts the exposure at up to 5,000 users (BleepingComputer).
• Current evidence shows no tampered build on the Visual Studio Marketplace, Open VSX or npm (Socket, StepSecurity).
• To fix it, run Cursor's check and cleanup script, confirm the persistence files are gone, rotate any credentials the machine could reach, and install 2.1.314 or later.

What happened

A tampered copy of the Claude Code extension appeared in Cursor's extension marketplace under the real publisher ID, Anthropic.claude-code, rather than a look-alike name. Cursor wrote that "a maliciously modified version of Anthropic's Claude Code extension was made available" and that it "runs malicious code that attempts to install a persistent SSH backdoor" (Cursor).

The macOS security firm Phorion published the first detailed analysis on October 30 (Phorion advisory). The story reached the top of Hacker News the same day. Early reports blamed Open VSX (the open extension registry that many VS Code-compatible editors use), npm or Microsoft's marketplace. Later checks pointed to Cursor's marketplace as the only distribution channel. Socket reviewed the Open VSX change feed and found no events for 2.1.313, though 2.1.312 and 2.1.314 were there (Socket).

Cursor first listed only 2.1.313. On October 30 at 11:30 a.m. PT it updated the notice to name 2.1.312 and 2.1.313 for Windows and macOS as affected. It also published separate file hashes for each modified package. The 2.1.312 builds on Open VSX and npm are the clean, official ones. Only Cursor's marketplace copies were modified.

Nobody has said publicly how the attacker got publish access to Cursor's marketplace. Anthropic's Felix Rieseberg said "this was not a compromise of Anthropic's systems or employee laptops" (quoted by StepSecurity). Anthropic skipped version 2.1.313 in its official releases and shipped 2.1.314 to avoid confusion.

Timeline

How the Claude Code extension backdoor worked

The attacker inserted a small loader at the top of the minified extension.js. The rest of the extension was left alone, so Claude Code kept working normally. StepSecurity measured the file at 3,692,922 bytes, about 7 KB larger than the clean 2.1.312 (StepSecurity).

The loader runs as soon as the editor loads the extension, before its normal activate function. You did not need to open Claude Code or type a prompt. Phorion CEO Calum Hall told Help Net Security: "The user doesn't need to interact with the extension for the payload to fire" (Help Net Security).

According to Phorion's analysis, the payload ran in four stages:

1. Plant a key. It appended an attacker-controlled Ed25519 public key with the comment svc-telemetry to ~/.ssh/authorized_keys. Then it tried to turn on the local SSH server.
2. Open a reverse tunnel. It connected out to 134.209.82.225 on port 22 as user tunnel, using ssh -N -R '*:0:localhost:22'. That exposes your machine's SSH port on the attacker's server, so the attacker can log in from there with the planted key.
3. Stay installed. On macOS it wrote ~/Library/LaunchAgents/com.apple.sysmond.plist, a name chosen to look like an Apple system service. On Windows it created a scheduled task called SysMon, with a sysmon.cmd file in the Startup folder as a fallback. On Linux it added an @reboot cron entry. A background loop retried the tunnel every 60 seconds.
4. Report home. It sent one JSON beacon over plain HTTP to 134.209.82.225:8099/beacon. The beacon held the hostname, username, OS, home and working directories, global Git email, and public IP. It also listed the names, not the values, of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP.

Bugs that limited the damage

The payload had several bugs. On macOS it checked Remote Login with systemsetup -getremotelogin without root. That command returns an error instead of "Off", so the code never tried to turn SSH on. On Windows it ran its PowerShell setup through /bin/sh, which a normal Windows install does not have (BleepingComputer). Cursor says installing the backdoor "would normally fail" without administrator rights.

You can still be exposed in these cases:

• If Remote Login was already on for your Mac, the attacker key plus the tunnel was enough for access. Phorion warns about this case explicitly.
• If Cursor ran with administrator rights on Windows, the setup could succeed.
• The beacon ran either way, so the attacker may have your hostname, username, Git email, public IP and the names of your secret variables.
• On Linux, Phorion found a cron-handling bug that can wipe your existing user cron jobs.

Are you affected?

You are likely affected if all of these are true:

• You use Cursor (not VS Code, Windsurf or another editor pulling from Open VSX).
• You run it on macOS (Apple Silicon) or Windows x64.
• You installed or updated the Claude Code extension between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026, and got 2.1.312 or 2.1.313 from Cursor's marketplace.

You are not affected by this incident if you only use the Claude Code CLI from npm, or the extension in VS Code from Microsoft's marketplace or Open VSX. The same goes if you never installed the extension. Socket found no malicious version in npm's version records (Socket).

Quick check

Cursor's notice gives a one-line check for macOS. It looks for the attacker key:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, search %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for svc-telemetry. The notice has a two-line PowerShell script for this. Cursor adds that you should follow the remediation steps "regardless" of what the check returns.

Other signs to look for:

• An extension folder named anthropic.claude-code-2.1.312-darwin-arm64, ...-2.1.313-darwin-arm64 or the win32-x64 equivalents
• Files ~/.config/.smt, ~/.config/.smtk or ~/.config/smt.cmd, and a key file .stk_ followed by 10 hex characters in your temp folder
• ssh or autossh processes connecting to 134.209.82.225
• An extension.js with SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15

How to clean up

Removing the extension is not enough. The persistence files live outside the extension folder. Use this order, based on Cursor's notice, Phorion and StepSecurity:

1. Isolate the machine if the check found the key or you see the tunnel process.
2. Run Cursor's cleanup script. Use remediate-macos.sh on macOS, run as your normal user, not root. Use remediate-windows.ps1 on Windows, from an elevated PowerShell. Both are linked from the Cursor security notice. They remove the extension, the persistence, the tunnel processes and the attacker key, and exit non-zero if anything remains.
3. Check by hand. Confirm that com.apple.sysmond.plist, the SysMon task, sysmon.cmd, the cron entry, .smt/.smtk and .stk_* are gone. Make sure Remote Login is off unless you need it.
4. Install version 2.1.314 or later of the extension.
5. Rotate credentials the machine could reach: Git hosting tokens, CI/CD secrets, cloud keys, SSH keys and package registry tokens. Do this from a clean device. Start with the environment variables whose names the beacon collected.
6. Review logs. Check SSH, process and login logs. Phorion flags successful SSH logins from 127.0.0.1 with the svc-telemetry key as a sign the tunnel was used. If it was, StepSecurity and Morphisec recommend rebuilding the machine (Morphisec).

What Cursor and Anthropic did

Cursor removed the tampered version, blocked further distribution and took the whole marketplace offline "out of an abundance of caution". It then audited access, confirmed no other extensions were tampered with, rotated its keys and rebuilt the marketplace before bringing it back. It also worked with the hosting provider to take the attacker server down. Cursor says it "no longer functions" (Cursor). Socket reports that Cursor is contacting affected users directly.

Anthropic says its own systems and official channels were not breached. It published 2.1.314 and skipped 2.1.313 in its official releases. Two questions are still open: how the attacker got publish rights on Cursor's marketplace, and why the extension's signature or integrity checks did not stop a modified file under Anthropic's name.

Why this matters for AI coding tools

AI coding extensions run with the developer's full user rights, sit next to source code and secrets, and update automatically, which makes them attractive targets. Here the attacker only had to change one file in a package published under the real extension ID. As Ax Sharma of Manifold Security put it to Help Net Security, "Checking the publisher name doesn't help when the publisher is real."

It follows other supply chain hits on AI developer tooling this month, including the LiteLLM 1.107.0 PyPI compromise. For teams, practical steps include:

• Pin and review editor extensions the way you pin package versions, and turn off auto-update for high-privilege extensions on sensitive machines.
• Alert on behavior. An editor helper process writing to authorized_keys or creating com.apple.* LaunchAgents should trigger an alarm.
• Keep long-lived secrets out of shell environments on developer laptops, since even variable names tell an attacker what to look for.
• Know which marketplace each editor uses. Cursor, VS Code and Open VSX-based editors pull from different registries, and an incident in one may not touch the others.

If you patch Node.js services too, see our note on Node2Shell (CVE-2026-111497) from earlier this week.

FAQ

Which Claude Code extension versions were malicious?

Cursor lists Anthropic.claude-code 2.1.312 and 2.1.313 for macOS (darwin-arm64) and Windows (win32-x64), as distributed by Cursor's own marketplace on October 29, 2026. The official 2.1.312 on Open VSX and npm is clean, and 2.1.314 is the fixed release.

I use Claude Code in VS Code. Do I need to do anything?

Probably not. Current evidence from Socket, StepSecurity and Cursor shows the tampered build was distributed only through Cursor's marketplace, not Microsoft's Visual Studio Marketplace, Open VSX or npm. Running the svc-telemetry key check takes seconds if you want to be sure.

Does uninstalling the extension remove the backdoor?

No. The SSH key, LaunchAgent, scheduled task, cron entry and helper files live outside the extension folder. Cursor and Phorion both say uninstalling alone is not enough. Run Cursor's remediation script, then check by hand.

Did the backdoor steal my API keys?

The beacon sent the names of up to 40 environment variables matching patterns like KEY, TOKEN and SECRET, but not their values, according to Phorion. If the reverse tunnel worked, though, the attacker could log in and read anything your user account can. Rotate credentials if you were exposed.

Was Anthropic hacked?

Anthropic says no. Felix Rieseberg said the incident "was not a compromise of Anthropic's systems or employee laptops." The tampered build appeared only in Cursor's marketplace. How the attacker got publish access there has not been disclosed.

Sources

• Cursor: Security notice on the malicious Anthropic.claude-code extension
• Phorion: Official Claude Code extension compromise advisory
• StepSecurity: Trojanized Claude Code extension delivered persistent SSH backdoor
• Socket: Cursor removes malicious Claude Code 2.1.313 extension
• BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors
• Help Net Security: Claude Code extension poisoned with persistent SSH backdoor
• Morphisec: What the trojanized Claude Code extension means for developer endpoints