Innhold Show
If you installed or automatically updated the Claude Code extension through Cursor, check the version number now. Version 2.1.313 was malicious, attempted to install a persistent SSH backdoor and may have reached up to 5,000 users.
The malicious release was available in the Cursor Extension Marketplace for roughly 11 hours on October 29, 2026. It collected information about the host, added an attacker-controlled SSH key, installed mechanisms designed to survive a restart and attempted to open a reverse SSH tunnel. All of that happened when the extension loaded. You did not need to start a Claude conversation or approve a suspicious command.
The distribution channel matters here. Cursor confirms the incident in its security notice, but says Anthropic did not develop the malicious version and that the company has found no evidence that other versions or the official distribution were affected. This is serious enough without stretching it beyond what the evidence supports.
What happened to the Claude Code extension?
A trojanized build of Anthropic.claude-code, version 2.1.313, was available through Cursor’s marketplace from approximately 2:27 a.m. to 1:35 p.m. Pacific Time on October 29. Cursor says no more than 5,000 users were affected and that it will contact those users directly.
The package looked like the familiar Claude Code extension, but its main extension.js file had a malicious loader placed in front of the legitimate code. OpenSourceMalware found 66 inserted lines of code that ran before the normal extension. The rest could continue to work much as expected because the malware suppressed almost all of its own errors.
That is especially nasty. A user could open Cursor, get the usual Claude Code experience and see no sign that extra code was working on SSH access and host reconnaissance in the background. This was not a fake extension with an almost-correct name. It was a manipulated version distributed under the familiar identity in the affected marketplace.
Who may have been affected?
The confirmed risk group consists of users who installed or updated Anthropic.claude-code to version 2.1.313 through the Cursor Extension Marketplace during the stated window on October 29. Cursor identifies malicious packages for macOS on Apple Silicon and Windows x64. Version 2.1.314 is the clean replacement named by the company.
This does not mean that every Claude Code, VS Code or Cursor user was compromised. OpenSourceMalware’s updated analysis limits the finding to the Cursor package and explicitly says that the npm package, Open VSX version and Microsoft VS Code Marketplace version were not malicious. Cursor also says Anthropic did not produce the malicious release.
Do not assume you are safe just because you cannot remember clicking an update button. Extensions can update automatically, and the exposure window was long enough for a work machine to receive the version during an ordinary day. Check the installed version and the traces on disk. Memory is not an incident log.
What did the malicious code do?
The malware first collected the hostname, username, operating system, processor architecture, home directory, working directories, configured Git email address and public IP address. It also collected the names of up to 40 environment variables containing terms such as KEY, TOKEN, SECRET, PASS, AWS or GCP. The initial reporting did not include the values themselves, but variable names can reveal which cloud services and types of secrets exist on a machine.
The code then added an Ed25519 key labelled svc-telemetry to the user’s authorized_keys file. The label looks boring and administrative, which is exactly how an unwanted key would prefer to look when someone skims the file. The malware also attempted to enable the local SSH service and create a reverse tunnel to the attacker’s server at 134.209.82.225.
To survive a restart, it created a LaunchAgent named com.apple.sysmond on macOS. On Windows, it attempted to create a scheduled task named SysMon as SYSTEM, with a startup script as a fallback. The background scripts tried to re-establish the tunnel roughly every 60 seconds. Host information and backdoor status were sent over unencrypted HTTP to port 8099.
Cursor says the attempt to enable SSH usually failed because it required administrator privileges that the extension did not have. In that case, the attacker could not log in through the tunnel. But the key was still added, persistence was still installed and host data was still transmitted. “The backdoor did not always work completely” is not the same as “nothing happened.”
Why is uninstalling the extension not enough?
The malicious loader left files and startup jobs outside the extension directory. Once written to the machine, those components could continue running after the Claude Code extension was removed or updated. Cursor therefore states explicitly that uninstalling may not be sufficient.
That is the entire point of persistence. Updating to 2.1.314 stops the malicious code from loading from the old package, but it does not automatically remove the attacker’s key, LaunchAgent, scheduled task, tunnel processes or every file the malware already created. A clean version number in the editor is not a clean bill of health for the machine.
The attacker’s server has been taken down in cooperation with the hosting provider. That stops the known tunnel and known reporting path now, but it cannot prove that an exposed machine was never accessed or examined while the server was active. If you find a confirmed indicator, treat the machine as compromised and respond accordingly.
How to check whether the machine has the SSH key
The clearest local indicator is the comment svc-telemetry in an SSH authorized-keys file. On macOS, Cursor provides this check:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"On Windows, check both the user’s key file and the system-wide administrator file. Run the following in PowerShell:
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }If you find the key, the machine was affected. Do not use that same machine to change passwords or rotate keys before it has been isolated and assessed. An attacker with persistent access might be able to observe or retrieve the new secrets as well. Perform the rotation from a system you trust.
What should affected users do now?
Start by disconnecting a machine with confirmed indicators from the network. If it belongs to a business, preserve logs and other evidence so the incident can be investigated before the traces disappear. Then remove the unauthorized SSH key, persistence jobs, tunnel processes, dropped files and malicious extension version.
Cursor has published cleanup scripts for macOS and Windows in its security notice. Run the macOS script as the affected user, not as root. Run the Windows script from PowerShell opened as an administrator. Read the script before running it, obtain it only from Cursor’s official notice and verify that it finishes without reporting remaining indicators.
Rotate GitHub and GitLab tokens, SSH keys, cloud credentials, CI/CD secrets, package-registry tokens and active sessions that the affected account could access. Do that from a clean machine. If the tunnel was actually active, or the machine handled valuable production secrets, a full reinstall is safer than assuming a list of known indicators covers everything the attacker may have done.
Upgrade to 2.1.314 or later after the cleanup. A business should check all endpoints, not just the computer belonging to the person who happened to notice the version. Search endpoint and network logs for the package name, affected version, svc-telemetry, the IP address, startup jobs and tunnel commands.
What do we still not know?
It has not been publicly established how the manipulated package entered the Cursor marketplace or who was behind it. Cursor says it removed the version, temporarily shut down the marketplace, reviewed access, rotated its own keys and rebuilt the marketplace. According to the company, its review found no other manipulated extensions.
We also do not know how many of the up to 5,000 users had the complete SSH chain working, or whether the attacker logged in to specific machines. Cursor believes that part would fail on most macOS and Windows systems because enabling SSH required higher privileges. That probably reduces the scale of successful remote access, but it does not erase the other actions performed by the malware.
Each claim should therefore stay at the level the evidence supports. We know that one specific Cursor-distributed version was malicious. We know what the code attempted and which indicators it left behind. We do not know that Anthropic’s official distribution infrastructure was broadly compromised, and we do not know that every user who received the package had an attacker actively enter the machine.
My assessment of the Claude Code incident
This is a serious supply-chain incident because a familiar developer extension ran malicious code under an identity users had reason to trust. Developer machines are also packed with exactly what an attacker wants: source code, Git access, cloud credentials, deployment permissions and connections further into production. This crosses an even uglier line than an AI coding tool making a destructive mistake: the package itself was manipulated before the user had a chance to ask it to do anything.
The most disturbing part is how little drama the user needed to see. No suspicious prompt. No strange installer. No obvious crash. The extension could continue working while errors were swallowed and the backdoor worked in the background. Trust in a familiar package name was the whole attack surface.
Precision is part of security work too. Calling this a proven compromise of Anthropic’s entire official distribution would be wrong and would make it harder to identify the people who were actually exposed. The correct warning is simpler: if you used the Cursor marketplace and received 2.1.313 on October 29, investigate the machine now. Do not stop at uninstalling. Find the indicators, remove the persistence and rotate whatever that machine could reach.
Frequently asked questions
Were all Claude Code users affected by the SSH backdoor?
No. The confirmed incident concerns Anthropic.claude-code version 2.1.313 from the Cursor Extension Marketplace during a limited window on October 29, 2026. Cursor has found no evidence that other versions or Anthropic’s official distribution were affected.
Is updating Claude Code to 2.1.314 enough?
No, not if version 2.1.313 already ran. The update replaces the malicious extension but may not remove the SSH key, startup jobs, tunnel processes or other files it left behind. Run the documented check and complete the cleanup.
Does svc-telemetry in authorized_keys mean the machine was compromised?
Yes. Cursor treats the presence of the key labelled svc-telemetry as confirmation that the malicious code ran. Isolate the machine, remove the persistence using the official measures and rotate accessible keys, tokens and sessions from a clean system.
Is the machine safe now that the attacker’s server is offline?
Not automatically. The known server is offline, so the identified tunnel and reporting path no longer work. That does not prove an exposed machine was untouched while the server was active. Local keys and persistence still need to be removed, and possible access must be investigated.
