Claude Code Extension Backdoor on Cursor: Check and Clean Up

Two tampered copies of the Claude Code extension, versions 2.1.312 and 2.1.313, were served from the Cursor Marketplace on October 29, 2026, and they tried to plant a persistent SSH backdoor on macOS and Windows machines. Searches for "claude code extension" jumped to the top of a 30-day Google Trends comparison on October 30 (read October 31, 2026), and the Hacker News thread passed 900 points. If you use Cursor, run the check below before you read the rest.

Check first#

Cursor's security notice says the malicious code appends an attacker key labelled svc-telemetry to your SSH authorized keys. Cursor's own macOS check is one line:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, Cursor gives a PowerShell version that also looks in C:\ProgramData\ssh\administrators_authorized_keys; copy it from the notice rather than retyping it. A second check from the security firm Phorion's write-up is to look for the installed extension folder, whose name includes the version:

ls -d ~/.*/extensions/anthropic.claude-code-2.1.31[23]* 2>/dev/null

Phorion lists the folder as ~/.<ide>/extensions/anthropic.claude-code-2.1.312-darwin-arm64, with the IDE directory name varying by editor, so the glob above is my generalisation of that pattern, not a command either vendor published. A hit means the bad version was installed. It does not prove the payload ran, and no hit does not clear you if you reinstalled or cleaned the folder. The authorized_keys check is the one to trust.

What happened#

According to Cursor, a maliciously modified Claude Code extension was available in its marketplace between about 2:27am and 1:35pm Pacific on October 29. Cursor removed it, shut the marketplace down, audited access, rotated keys and rebuilt it. It also worked with the hosting provider to take the attacker's server offline.

Anthropic's position, posted on the HN thread by Felix Rieseberg, is that this was not a compromise of Anthropic's systems or employee laptops. In his words, a malicious actor "used access to Cursor's marketplace" to publish a tampered copy that Anthropic did not build or publish, and the versions on Anthropic's official channels are not affected. This only affects Cursor users.

One thing the sources do not settle is how the attacker got in. Cursor says "access", Anthropic repeats it, and neither describes the mechanism. Treat any detailed claim about the entry point as unconfirmed.

What the payload does#

Phorion's analysis of the sample is the most detailed public account. The injected code runs when Node loads extension.js, before the extension's normal activate function, so you did not have to click anything. In order:

1. It appends the svc-telemetry public key to ~/.ssh/authorized_keys.
2. It tries to turn on the local SSH service.
3. It opens an outbound reverse SSH tunnel to 134.209.82[.]225, retrying about every 60 seconds.
4. It installs persistence: a LaunchAgent named com.apple.sysmond on macOS, a scheduled task named SysMon on Windows.
5. It sends one HTTP beacon with hostname, username, OS, home directory, Git email, public IP and up to 40 environment variable names matching words like KEY, TOKEN and SECRET.

The beacon sends variable names, not values. That is still useful to an attacker: it is an inventory of which machines hold cloud credentials worth chasing.

Both sources agree the attack was less effective than it could have been. Cursor says turning on SSH needs admin rights the extension usually lacks. Phorion found a bug where the macOS check for Remote Login reads an administrator-access error as if SSH were already on, so the enable step is skipped. Phorion also warns this is no defence: if Remote Login was already on, or gets turned on later, the planted key still works.

The part that matters for cleanup: Cursor and Phorion both say uninstalling the extension is not enough, because the payload drops standalone persistence scripts and a detached tunnel loop that survive the IDE closing.

What to do if the check hits#

Follow Cursor's order. Isolate the machine, remove the key, persistence and tunnel processes (Cursor publishes remediation scripts for macOS and Windows), consider rebuilding the host, and rotate credentials that user account could reach, from a different trusted machine. Cursor notes the limited environment collection "does not rule out later credential access over the backdoor". Check SSH logs too: Phorion says logins through the tunnel appear to come from localhost using the svc-telemetry key.

The angle: "Made by Anthropic" is a label, not a signature#

The incident is a supply-chain story about trust labels. Developers saw an extension named after Anthropic in an editor marketplace and treated it as Anthropic's. This is the same class of risk we covered when Claude Code plugins could be installed from a URL, and it fits the argument in agent config files are an executable supply chain: anything an agent or editor loads and runs with your user's permissions deserves the scrutiny you give a dependency.

What a builder does Monday:

• Pin the install path. In Cursor, treat the marketplace copy of a vendor's extension as a third-party artifact. If you can, install the vendor's own build from the vendor's documented channel and compare hashes with the ones Cursor published for the bad versions.
• Protect ~/.ssh. An IDE extension host has no business writing authorized_keys. Phorion's detection advice is to alert on editor helper processes modifying that file, because process-only rules watching echo or tee miss a Node appendFileSync.
• Run the same checklist you use for MCP servers. Our pre-connection agent security checklist applies to editor extensions with minor edits: who publishes it, can you verify that, what can it touch.
• Do not assume the terminal CLI is the same risk. Both sources describe the problem as a tampered VS Code-family extension distributed through one marketplace. Nothing in either says the claude CLI installer was affected, and I found no claim to that effect.

For context on how the main coding agents differ on isolation, see AI coding agent security models compared and the broader Claude Code vs Cursor vs Codex comparison.

What people are actually saying#

The HN thread has 920 points and 536 comments at the time of reading. The discussion splits in three ways:

• Whose problem is it? One commenter argued it is "just as much Anthropic's problem" because the listing carries Anthropic's name, and asked for either signing keys Anthropic controls or removing the branding. Another replied that the attacker simply published something under that name, and Cursor should have blocked the use of an AI lab's name by an unverified publisher.
• Signing is a solved problem. Several commenters asked why the marketplace does not verify signatures. A counterpoint in the thread is that code signing and organisation verification are different things, and that many package ecosystems do the first without the second.
• Enterprise pain. A commenter at a large company said they block extensions by default and approve them one by one, which this incident makes harder to argue against.

These are paraphrases of individual commenters, not a survey. The thread also contains confident, conflicting claims about how Cursor's marketplace relates to other registries that I could not verify, so I have left them out.

Continue Reading#

• Claude Code plugin URLs turn skills into a supply chain - the earlier warning about installing agent extensions from arbitrary sources
• Agent config files are an executable supply chain - why anything your agent loads needs review
• Agent security checklist before connecting tools - a pre-install checklist that fits extensions too
• AI coding agent security models compared - sandboxing and permission models side by side
• Cursor 0-day git.exe vulnerability - another editor-level attack path
• Claude Code - install routes and alternatives on one page

FAQ#

Is the Claude Code extension safe to use?#

Cursor and Anthropic both say only Cursor Marketplace copies of versions 2.1.312 and 2.1.313 were malicious, and that the versions on Anthropic's official channels are not affected. Cursor says it has no evidence that other versions or the official distribution are affected.

How do I check if I was affected by the Claude Code extension backdoor?#

On macOS, run grep -qs svc-telemetry ~/.ssh/authorized_keys and see whether it matches. Cursor publishes the Windows PowerShell equivalent in its security notice. If the key is found, treat the machine as impacted.

Does uninstalling the extension remove the backdoor?#

No. Cursor and Phorion both say the payload drops standalone persistence scripts and a tunnel loop that keep running after the extension is removed.

Did the attackers steal my API keys?#

The beacon described by Phorion sends environment variable names matching words like KEY and TOKEN, not their values. Cursor still advises rotating credentials the affected user could reach, since a working backdoor could allow later access.

Sources#