A backdoored Claude Code extension, 2.1.313, reached Cursor users. How to check

What happened on October 29

For about 11 hours on October 29, 2026, Cursor’s extension marketplace offered a tampered version of Anthropic’s Claude Code extension. Cursor’s security notice gives the details: Anthropic.claude-code version 2.1.313 was available “between about 2:27am PT and 1:35pm PT,” it “runs malicious code that attempts to install a persistent SSH backdoor,” and “at most 5,000 users were affected.” Cursor says it will contact them directly.

Cursor pulled the version, shut its whole extension marketplace down for a while, rotated its keys, rebuilt the marketplace and checked that no other extension had been changed. It also had the attacker’s server taken offline.

The alarm went up publicly on the morning of October 30, when the researcher Kevin Beaumont posted “Anthropic got compromised,” pointing to Phorion’s analysis, which found the backdoor in the Cursor Marketplace bundle. Anthropic published version 2.1.314 to npm, Open VSX and Microsoft’s Visual Studio Marketplace on the evening of October 29, Central Time.

What the backdoor does

According to Phorion, code was added to the top of the extension’s extension.js (66 lines, by The Hacker News’s count), so it runs as soon as the editor loads the extension, before you ever open Claude. It tries to:

1. Add the attacker’s SSH key to ~/.ssh/authorized_keys, with the comment svc-telemetry.
2. Turn on SSH and open a reverse SSH tunnel to 134.209.82.225, which would let the attacker log in to your machine through it. A background loop retries every 60 seconds.
3. Stay on the machine: a LaunchAgent named com.apple.sysmond on macOS, a scheduled task named SysMon plus a Startup-folder script on Windows, and, per Phorion, an @reboot cron entry on Linux.
4. Report the machine: hostname, username, operating system, home folder, working folders, Git email, public IP, and the names (not the values) of up to 40 environment variables matching words like KEY, TOKEN and SECRET.

There’s a mitigating bug. Turning SSH on needs administrator rights, which Cursor says the extension doesn’t have on most Macs and Windows PCs, so “the attacker could not have logged in through the tunnel” on those. The key, the persistence and the report still happen. And Phorion warns that if you turn on Remote Login later, the planted key works.

Who’s affected, and who isn’t

Where you got the extension	Version 2.1.313?
Cursor’s extension marketplace, October 29, 2:27 a.m.–1:35 p.m. PT	Yes, the tampered build
Microsoft’s Visual Studio Marketplace (VS Code)	No: it lists 2.1.312, then 2.1.314
Open VSX	Not now; reports disagreed early on
The Claude Code CLI on npm	No: npm lists 2.1.312, then 2.1.314
Claude Code in the terminal, Claude Desktop or the web	Not reported

Early reports said Open VSX had served it too. OpenSourceMalware and The Hacker News have since corrected that to the Cursor Marketplace, and OpenSourceMalware says the npm package, the Open VSX extension and Microsoft’s listing “are NOT malicious.” Open VSX returns “Extension not found” for 2.1.313.

How to check your machine

Cursor’s test looks for the planted key. On macOS (it works the same on Linux):

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, in PowerShell:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

On a Mac, a second sign is the backdoor’s LaunchAgent, named to look like Apple’s: ls ~/Library/LaunchAgents/com.apple.sysmond.plist should report no such file. Checking the extension’s version isn’t enough on its own, because it has likely auto-updated to 2.1.314 since.

What to do if you’re affected

1. Run Cursor’s remediation script. Download remediate-macos.sh and run it as yourself, not as root, or remediate-windows.ps1 from an administrator PowerShell. Cursor says they remove the extension, the persistence, the tunnel processes and the key, and exit with an error if anything remains.
2. Don’t rely on the update or an uninstall. “Uninstalling the extension may not be sufficient,” Cursor says, and Beaumont confirmed that 2.1.314 does “not remove the prior backdoors.”
3. Rotate what the machine could reach, from another, trusted computer: cloud and API keys, GitHub tokens, and your agents’ logins. Sign out of every session at the company, not just on the laptop.
4. At work, tell your security team. Cursor recommends isolating affected machines and deciding whether to rebuild them. Phorion and Cursor publish the file hashes and indicators to search for.

What Anthropic hasn’t said

Anthropic hasn’t published a statement, on its news page, its status page or its GitHub security advisories, as of midday October 30. Nobody has explained how a build under Anthropic’s name reached Cursor’s marketplace. Cursor says the version “was not developed by Anthropic.” Beaumont calls that “a bit wordsmithy,” saying it was uploaded to Anthropic’s verified account, and adds that Anthropic “won’t comment.” We’ll update this memo when Anthropic says what happened.