Claude Code 2.1.313 in Cursor's Extension Marketplace Was Backdoored: Check Your SSH Keys Now

TL;DR: Cursor says a malicious copy of Anthropic’s Claude Code extension, version 2.1.313, sat in Cursor’s own VS Code extension marketplace for about 11 hours on October 29, 2026 (Pacific time). Anthropic didn’t build it. It reached at most 5,000 users, and it tries to add an attacker’s SSH key, open a reverse SSH tunnel and survive reboots. If you use Claude Code inside Cursor, run Cursor’s one-line check for a key labelled svc-telemetry today.

What happened

In a security notice dated October 29, 2026, Cursor said “a maliciously modified version of Anthropic’s Claude Code extension” was available in the Cursor VS Code extension marketplace between about 2:27 a.m. and 1:35 p.m. PT that day. In Manila time that is 5:27 p.m. on October 29 to 4:35 a.m. on October 30. Cursor says the build “was not developed by Anthropic” and that “at most 5,000 users were affected.” It says it will contact them directly.

According to Cursor, the extension:

• collects host details: hostname, username, OS, home folder, the names of environment variables, working folders, your Git email and your public IP;
• adds an attacker-controlled SSH key, labelled svc-telemetry, to your authorized_keys file, tries to turn on the SSH service and open a reverse SSH tunnel to 134[.]209[.]82[.]225;
• sets up persistence through a LaunchAgent on macOS, or a scheduled task with a Startup-folder fallback on Windows, and retries the tunnel about every 60 seconds;
• reports back with an HTTP POST to /beacon on port 8099.

Cursor says turning on SSH needs admin rights that the extension doesn’t have on most Macs and Windows PCs. On those machines that step fails, and the attacker couldn’t log in through the tunnel. The key, the persistence and the data report still happen, though. The attacker’s server is now offline. Cursor pulled the version, shut its marketplace down, rotated its keys, rebuilt the marketplace and says no other extensions were tampered with. It hasn’t said how the build got in. Reuters reported that Anthropic didn’t immediately respond to a request for comment.

Why it matters

Our read: this one targets the machine you code on. That laptop holds SSH keys, cloud logins, .env files and Git access. The extension only grabbed the names of your environment variables, not their values. But a planted SSH key plus a tunnel is a door, and Cursor itself warns that the limited collection “does not rule out later credential access over the backdoor.”

It’s also a reminder that the extension marketplace is part of your supply chain, just like npm, and AI coding tools update often and automatically. We covered a similar developer-machine attack earlier this week, the GhostAction campaign that hid a stealer in a VS Code task.

At our check on October 30, version 2.1.313 wasn’t listed on the VS Code Marketplace, Open VSX or npm. All three show 2.1.314, published early on October 30 (UTC), as the latest.

What to do now

1. Check whether you’re hit. If you installed or updated Claude Code in Cursor on October 29, run Cursor’s check. On macOS:

   grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

   On Windows, copy the PowerShell check from Cursor’s notice. It also looks in C:\ProgramData\ssh\administrators_authorized_keys.

2. If the key is there, take the machine off the network and run Cursor’s remediation script: remediate-macos.sh as your normal user (not root), or remediate-windows.ps1 from an Administrator PowerShell. Cursor says the scripts remove the extension, the persistence, the tunnel processes and the key, and exit with an error if anything is left. Cursor says uninstalling the extension may not be enough, because the persistence scripts keep running.

3. Rotate secrets from another computer. Change the cloud, Git, API and SSH credentials that machine could reach, and sign out its sessions. Do it from a clean device, as Cursor advises. If you’re unsure, rebuild the machine.

4. Teams: search your endpoint and network logs for the indicators in Cursor’s notice (the IP, port 8099, the SysMon task and the com.apple.sysmond LaunchAgent).

Our tip: even if you’re clean, check ~/.ssh/authorized_keys on your dev machines now and then. Most laptops don’t need one at all. If you don’t run an SSH server on your laptop, keep remote login off. Cursor says that’s why the tunnel login failed on most machines, though the key, persistence and data report still went through. For more patch and incident guides, see our security hub.

Sources & method

Source	What it confirms	Link
Cursor security notice (Oct 29, 2026)	Version 2.1.313, the time window, up to 5,000 users, not built by Anthropic, behaviour, the check commands, remediation scripts and indicators	Cursor
Visual Studio Marketplace: Anthropic.claude-code	Latest is 2.1.314; no 2.1.313 listed (checked Oct 30)	Marketplace
Open VSX: Anthropic/claude-code	Latest is 2.1.314, published Oct 30, 2026, 01:07 UTC; no 2.1.313 listed	Open VSX
npm: @anthropic-ai/claude-code	2.1.314 published Oct 30, 2026, 00:12 UTC; no 2.1.313	npm
Reuters, via CNA (Oct 30, 2026)	Cursor’s statement; Anthropic didn’t immediately comment	CNA
The Hacker News (Oct 30, 2026)	Independent coverage of the incident	The Hacker News

Last checked: Oct 30, 2026, 7:00 p.m. Manila (UTC+8). Method: We read Cursor’s notice and checked the extension’s version history on the VS Code Marketplace, Open VSX and npm ourselves. Times are converted from Pacific Daylight Time (UTC−7). Tips marked “Our tip” and analysis marked “Our read” are ours. The thumbnail is an original OneSignalDesk card summarising Cursor’s notice. No affiliate links. How we work.

Updates

• Oct 30, 2026, 9:00 p.m. Manila: First published. Cursor hasn’t said how the build got into its marketplace, and Anthropic hasn’t commented. We’ll add a dated note if either changes.