Check your machine for the tampered Claude Code extension in Cursor

If you installed or updated Claude Code inside the Cursor editor on Oct 29, run one command today to see whether a tampered copy put an attacker's SSH key on your computer. Cursor says "At most 5,000 users were affected, and we will reach out directly." The check takes seconds, and everyone should update to 2.1.314 either way.

What changed#

Cursor's security notice says a "maliciously modified version of Anthropic’s Claude Code extension", version 2.1.313, was in its extension marketplace "Between about 2:27am PT and 1:35pm PT" on Oct 29, which is 5:27 AM to 4:35 PM ET. It "was not developed by Anthropic." According to the notice, the extension:

• collects host details, including hostname, username, environment variable names, configured Git email and public IP;
• tries to add an attacker key labeled svc-telemetry to authorized_keys, turn on the local SSH service and open a reverse SSH tunnel;
• tries to keep that tunnel alive with a LaunchAgent on macOS or a scheduled task on Windows, and "Background scripts retry the tunnel roughly every 60 seconds";
• reports back by HTTP POST to /beacon on port 8099.

Cursor says it removed the version "immediately upon detection", then ran "a full shut down of the VSCode Marketplace out of an abundance of caution." It "audited access and confirmed no other extensions were tampered with," then "rotated our keys, rebuilt the marketplace, and brought it back online." The notice adds: "The attacker server no longer functions."

Cursor posted on X at 3:46 AM ET Friday that the incident "does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products," and asked "all customers" to update to Claude Code for VS Code 2.1.314.

Why it matters#

This hit developers who run an AI coding agent inside their editor, the people most likely to have cloud keys, repo tokens and production sessions on the same laptop. Removing the extension is not the whole fix. Cursor warns that "Uninstalling the extension may not be sufficient" because "the payload drops standalone persistence scripts that keep running." It also says "The limited env-var collection does not rule out later credential access over the backdoor."

How to use it#

Cursor's cleanup steps apply "If you installed or updated to Anthropic.claude-code 2.1.313 from Cursor VS Code extension marketplace between 2:27am PT and 1:35pm PT on October 29, 2026". If you are not sure, run the check anyway.

1. Check for the key. On macOS, run Cursor's one-line check:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, run this in PowerShell:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

Cursor says: "If the key is found, your machine is impacted."

2. If it is, isolate that computer. The notice says to isolate hosts "showing evidence of payload execution or backdoor installation."
3. Run Cursor's cleanup script. On macOS, download remediate-macos.sh and run bash remediate-macos.sh "as the affected user, not as root." On Windows, download remediate-windows.ps1 and run powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1 from PowerShell opened with Run as Administrator. The scripts "exit with a non-zero status if anything remains." Cursor also says to "assess whether the host should be rebuilt."
4. Rotate secrets from somewhere else. Cursor's words: "Rotate credentials and sessions accessible from affected hosts, from a trusted system."
5. Everyone: update Claude Code for VS Code to 2.1.314. Open VSX listed 2.1.314 as the latest version when we checked.

Security teams should also follow the notice's step to search "endpoint, network, and extension-installation telemetry" for its indicators, which include the macOS file ~/Library/LaunchAgents/com.apple.sysmond.plist and the attacker address.

Ask your Bot to run the Mac check for you (ours, untested):

On this Mac, run grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted" and tell me the exact output. Change nothing.

Good to know#

• Admin rights limited the damage, not the cleanup. Cursor says turning on the local SSH service "requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails and the attacker could not have logged in through the tunnel." It still says "Follow the remediation steps below regardless," because the key, persistence and host report still land.
• Only the Cursor marketplace copy is named. Cursor has "no evidence that other versions of the extension or the official distribution are affected." Open VSX's version list showed 2.1.314 and 2.1.312 but no 2.1.313 when we checked. OpenSourceMalware, which published an early analysis, lists the npm package, the Open VSX extension and the Microsoft extension as "NOT malicious."
• Grok Bot is not affected, per Cursor's X post above.
• The same update brings a new guardrail. Anthropic's Claude Code 2.1.314 release also adds permissions.blockWritesOutsideWorkingDirectories; see today's digest.
• Questions go to security@cursor.com, per the notice.

What to watch#

• Direct notices from Cursor. It says it "will reach out directly" to affected users.
• How the bad build got in. The notice does not say.
• Anthropic. Anthropic "did not immediately respond to a request for comment," CNA reported. We found no Anthropic post about it on X.

Last checked: Oct 30, 2026, 7:07 to 7:12 AM ET. What changed: first published Oct 30.

Sources#

• Cursor blog: Security notice, malicious version of Anthropic.claude-code (2.1.313) in the Cursor Extension Marketplace
• Cursor on X: security incident post (Oct 30, 3:46 AM ET)
• Open VSX: Anthropic Claude Code extension
• OpenSourceMalware: Trojanized Claude Code extension plants persistent SSH backdoor
• CNA: Cursor says up to 5,000 users affected by tampered Claude Code extension