A backdoored Claude Code extension reached Cursor users: how to check your machine
For about 11 hours on October 29, Cursor's extension marketplace served tampered builds of the Claude Code extension that planted an attacker's SSH key and a startup script. Cursor puts the reach at 5,000 users at most. The official VS Code Marketplace and Anthropic's own channels weren't affected.
What happened
Cursor's security notice says that on October 29, between 2:27 am and 1:35 pm Pacific (09:27 to 20:35 UTC), its marketplace served modified builds of Anthropic.claude-code, versions 2.1.312 and 2.1.313, for macOS and Windows. Cursor's post on X puts the number affected at 5,000 users at most and asks everyone to move to version 2.1.314.
Phorion, the security firm that reported the backdoor, shows in its write-up that the injected code runs as soon as the editor loads the file, before the extension itself starts, so nobody had to open Claude Code for it to fire.
Felix Rieseberg of Anthropic wrote that someone used access to Cursor's marketplace to publish a tampered copy. Neither company has said how the attacker got that access.
Are you affected?
Only if you use Cursor and its marketplace installed or updated Claude Code during that window. Anthropic's Rieseberg says it only impacts Cursor users, so installs from anywhere else aren't part of this incident.
On a Mac, Cursor's one-line check looks for the attacker's key, which carries the label svc-telemetry:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"The notice has a PowerShell version for Windows that also reads the administrators' key file.
What the payload does
| Step | What it tries | Did it work? |
|---|---|---|
| Report the machine | Hostname, username, OS, home folder, Git email, public IP, names of environment variables like *_TOKEN | Yes |
| Plant a login key | Appends the attacker's key to ~/.ssh/authorized_keys | Yes |
| Open a way in | Turns on the local SSH server, then holds a reverse tunnel to the attacker | Cursor says it fails unless Cursor was started as administrator |
| Survive a reboot | A LaunchAgent named com.apple.sysmond on macOS; a SysMon task or Startup script on Windows | Yes, retrying every 60 seconds |
The beacon sends up to 40 variable names, never their values. Cursor says it had the hosting provider take the attacker's server offline, so the tunnel and the beacon now go nowhere. Where the SSH step failed, nobody could log in through the tunnel. The key and the startup script remain on the machine.
If the key is there
- Don't stop at uninstalling. Cursor warns that uninstalling may not be enough, because the startup scripts keep running on their own.
- Run Cursor's cleanup script.
remediate-macos.shruns as your normal user andremediate-windows.ps1from an administrator PowerShell. Both are linked from the remediation section and exit with an error if anything is left. - Rotate secrets from another computer. Start with the tokens whose names the beacon could see.
- Update the extension to 2.1.314 once the machine is clean.
Treat a Mac that already had Remote Login switched on as a real break-in: Phorion notes that on such a machine the backdoor was ready and waiting. Phorion's remediation list covers the Linux cron entry too, as the code has a Linux path even though Cursor lists only macOS and Windows builds.
What it means for you
Run the grep even if you don't remember updating anything that day. Then switch your extensions to manual updates, so a bad release waits for you to read about it.
Try it
Below is the list of extensions installed in my code editor (folder names with versions). For each one: 1) Who publishes it, if the name tells you. Say "unknown" if it doesn't. 2) Can it run shell commands or read files outside the project? Answer yes / no / unsure. 3) Keep, review or remove, with one reason. Then list the ones I should switch to manual updates. Don't guess a publisher you aren't sure of. Editor: [Cursor, VS Code or another editor] Extensions: [paste the output of: ls ~/.cursor/extensions]
A machine of mine may have been exposed. Help me plan rotating secrets in a safe order. For each secret below, give: - where it's issued (the service and the page or command), - what breaks while it's being replaced and how to avoid downtime, - whether it should be revoked first or after the new one works. Order the list so that anything granting access to other secrets comes first. Don't ask me to paste the secret values. Names are enough. Secret names: [e.g. AWS_ACCESS_KEY_ID, GITHUB_TOKEN, ANTHROPIC_API_KEY] What runs on this machine: [e.g. deploys, CI scripts, local dev only]
Sources
- Cursor, Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313), October 29, 2026, updated October 30
- Cursor, post on X, October 30, 2026
- Felix Rieseberg (Anthropic), post on X, October 30, 2026
- Phorion, Official Claude Code Extension Compromise: Security Advisory, October 30, 2026, updated October 31