Home GuidesMalicious Claude Code extension in Cursor (2.1.313): what to do

Guide

Malicious Claude Code extension in Cursor (2.1.313): what to do

A tampered Claude Code extension (2.1.312, 2.1.313) shipped via Cursor's marketplace on Oct 29, 2026. Check for the svc-telemetry key, clean up, rotate.

Published October 30, 202613 min read

Independent notes from VibeLocked. Not a pentest, and not affiliated with the tools named below.

On October 29, 2026, a tampered build of Anthropic's Claude Code extension was served to Cursor users through the Cursor VS Code Extension Marketplace for about eleven hours. It tried to plant an SSH backdoor: it added the attacker's public key to ~/.ssh/authorized_keys, set up a startup task to keep a reverse SSH tunnel alive, and sent details about the machine to the attacker. Removing or updating the extension does not undo any of that.

This guide covers what is confirmed, how to check your machine with the same indicators Cursor published, how to clean up, what to rotate if the key was there, and what to change so a bad extension update cannot reach you the same day it ships.

Checked on October 30, 2026 against Cursor's security notice (including its Oct 30, 11:30am PT update) and its two remediation scripts, statements from Anthropic staff, and write-ups from Socket, Sophos X-Ops, OX Security and Geordie AI, all linked in the sources. The macOS and Linux check commands below were run on a test home folder with planted fake artifacts and on a clean one. The Windows commands come from Cursor's notice and were not run by us. VibeLocked is independent and not affiliated with Cursor or Anthropic.

The short version

Run Cursor's check. If svc-telemetry is in your authorized_keys, the machine was hit. Command below.
If it was hit, run Cursor's remediation script for your platform. It removes the tampered extension, the persistence, the tunnel processes and the key, and exits non-zero if anything is left.
Do not clean the key with grep -v. Cursor's script notes the key was appended without a newline, so it can share a line with one of your real keys.
Rotate from a different, trusted machine: SSH keys, git tokens, cloud and database credentials, AI provider keys, and every .env value that machine could read.
Update the extension to 2.1.314 or later. Anthropic says it skipped to 2.1.314 so the real release is easy to tell apart.
Add an install cooldown so new extension versions wait before installing.

What happened, according to the sources

Facts below come from Cursor's notice unless another source is named.

What: a "maliciously modified version" of the Anthropic.claude-code extension, "not developed by Anthropic," was available in the Cursor VS Code Extension Marketplace.
When: between about 2:27am and 1:35pm PT on October 29, 2026 (09:27 to 20:35 UTC, as Sophos converts it).
Which versions and platforms: Cursor's notice now names 2.1.312 and 2.1.313 for macOS and Windows. It was updated on October 30 at 11:30am PT to "clarify affected versions." Earlier coverage of Cursor's notice by Sophos, OX Security and Socket named only 2.1.313.
What the code did: collected hostname, username, OS, architecture, home folder path, environment variable names, working directories, configured Git email and public IP, and sent them to the attacker. It added an attacker SSH key to authorized_keys, tried to turn on the local SSH service and open a reverse SSH tunnel, and set up persistence (a LaunchAgent on macOS, a scheduled task with a Startup script fallback on Windows) that retries the tunnel about every 60 seconds.
How far it got: turning on the SSH service needs admin rights. Cursor says that because of "errors in the malicious code," that step fails unless Cursor was started with administrator privileges, and on those hosts "the attacker could not have logged in through the tunnel." It still added the key, installed persistence and sent host details.
The attacker server: Cursor worked with the hosting provider to take it offline, so the tunnel and the data POST no longer work.
What Cursor did: removed the version, blocked distribution, then shut down the whole marketplace "out of an abundance of caution," audited access and found no other extensions tampered with, rotated its keys, rebuilt the marketplace and brought it back. The Register quotes the same steps.
Anthropic's position: Felix Rieseberg of Anthropic said, as quoted by The Register, that "a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish," that it "wasn't a compromise of Anthropic's systems or employee laptops," and that "this only impacts Cursor users." Another Anthropic engineer wrote on Hacker News that 2.1.313 "was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts" and that Anthropic made its next update 2.1.314 "to disambiguate."
Open VSX and npm: an early report attributed the bad version to Open VSX. Socket reviewed the Open VSX change feed and npm metadata and found no publication or removal record for 2.1.313 on either. That early report has since been revised.

What the sources do not agree on, or do not say

Versions. Cursor's current notice says 2.1.312 and 2.1.313. Sophos, OX Security, Socket and Geordie, written before or from the earlier notice, say only 2.1.313. A genuine 2.1.312 also exists: Socket shows it on npm, published October 27 at 18:36 UTC, and on Open VSX. Cursor's script notes the tampered bundle "keeps the real version number," so a version number alone does not tell you whether you got the bad build. Check the indicators instead.
How many people. Socket, Sophos, OX Security, Geordie and The Register all say Cursor estimated up to 5,000 users. The Cursor notice as we read it on October 30, after its update, does not state a number. We could not load an archived copy of the original to confirm the figure.
File hashes. OX Security and Geordie list a macOS (darwin-arm64) package hash for 2.1.313 that differs from the one in Cursor's updated notice. The Windows hash matches, but Cursor now lists it under 2.1.312. If you match on hashes, use Cursor's current list and do not rely on a hash match alone.
Linux. Cursor names macOS and Windows builds, but its indicator list also includes Linux paths (a @reboot cron entry and /tmp/.stk_*), and The Register describes the backdoor as written for Windows, macOS and Linux. If you use Cursor on Linux and updated the extension that day, run the check anyway.
How the tampered copy got into Cursor's marketplace. Neither Cursor nor Anthropic has said. The Register notes this too.
Start time. Social posts gave different start times. The only official window is Cursor's, 2:27am to 1:35pm PT.

Step 1: Check your machine

Cursor's own check on macOS (in Terminal, not a browser):

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, in PowerShell, Cursor's check also looks at the system-wide admin key file:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

If you want to see the other indicators Cursor published as well, this read-only block works on macOS and Linux. It deletes nothing and prints only file names, the attacker's public key line, and matching processes:

# 1. The attacker's public key (comment svc-telemetry)
grep -s svc-telemetry ~/.ssh/authorized_keys

# 2. Tampered extension bundles in any VS Code based editor (Cursor, VS Code and others).
#    Matches on content, because the bad build kept a normal version number.
grep -lF svc-telemetry ~/.*/extensions/anthropic.claude-code-*/extension.js 2>/dev/null

# 3. Dropped files and persistence
ls -la ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist \
  "$TMPDIR"/.stk_* /tmp/.stk_* 2>/dev/null
crontab -l 2>/dev/null | grep -F .smt

# 4. Tunnel or retry loop still running
ps -axo pid,command | grep -E '\.stk_|\.config/\.smt' | grep -v grep

Empty output from all four means none of those indicators are present. In our test home folder with fake artifacts, each line found its planted file, and a fake retry loop showed up in step 4. On a clean folder, nothing printed. If Cursor already updated the extension, step 2 can come back empty even on a hit machine, so steps 1 and 3 matter more.

On Windows, the matching places per Cursor's notice are a scheduled task named SysMon, %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd, %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk and %TEMP%\.stk_*. For example, schtasks /query /tn SysMon should say the task does not exist.

The label com.apple.sysmond is made to look like an Apple service. It is not one.

Step 2: Clean up a machine that was hit

Cursor published two scripts, linked from its notice: remediate-macos.sh (run as the affected user, not with sudo) and remediate-windows.ps1 (run from PowerShell opened as Administrator; it cleans every user profile, so close all editors first). We read both. They:

unload the com.apple.sysmond LaunchAgent or remove the SysMon task,
kill the tunnel processes,
delete any anthropic.claude-code-* extension folder whose extension.js contains svc-telemetry, in any VS Code based editor,
delete .smt, .smtk, smt.cmd, sysmon.cmd and the .stk_* key files,
remove the attacker key from authorized_keys without touching your other keys,
exit with an error if anything is left, and tell you if something is listening on port 22.

That last point about keys is why you should not use the common grep -v svc-telemetry trick. Cursor's script says the key "is appended without a leading newline, so it may share a line with a real key." We tried it on a test file where that happened: grep -v removed the whole line, so the real key went with it. If you clean by hand, open authorized_keys in an editor and remove only the text from ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDdvylCEJ/k2TpezcTfedrkHyFSK9IZ3vmP6vhY4Ss0P through svc-telemetry.

Download the scripts from Cursor's notice itself, read them, then run them. Do not run a cleanup script someone pasted into a forum or a chat.

Then, per Cursor:

Assess whether to rebuild the machine. If it had admin level access at the time (Cursor started as administrator), or you find signs the tunnel connected, treat the machine as fully compromised and reinstall.
Look for logins through the tunnel. Geordie AI suggests checking SSH logs for logins from 127.0.0.1 or ::1 with the attacker key fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, since a tunneled login shows up as local. Per Cursor, if the SSH service could not be turned on, the attacker could not log in this way, so on most machines this should come back empty.
Update the Claude Code extension to 2.1.314 or later after cleaning.

Step 3: Rotate what the machine could read

Cursor's advice is to "rotate credentials and sessions accessible from affected hosts, from a trusted system," because the limited environment variable collection "does not rule out later credential access over the backdoor." Do it from another computer or your phone, not the one being cleaned.

For a typical vibe coder's laptop, "accessible" means:

SSH keys in ~/.ssh. Make new ones, add the new public keys to GitHub, servers and anything else, then delete the old ones there.
Git hosting tokens: GitHub personal access tokens, gh CLI logins, ~/.git-credentials, deploy keys. Check GitHub's security log for anything you did not do.
Every .env file in every project folder, including .env.local and backup copies. That means Supabase service role keys, database URLs with passwords, Stripe secret keys, Clerk secret keys, webhook secrets and JWT secrets.
Cloud and hosting CLIs: AWS, Google Cloud, Azure, Vercel, Netlify, Cloudflare (Wrangler), Firebase, Supabase CLI tokens and ~/.npmrc publish tokens. Revoke the session or token in each dashboard, then log in again.
AI provider keys (OpenAI, Anthropic, Gemini, OpenRouter) and anything in MCP or agent config files.
Anything exported in your shell profile (.zshrc, .bashrc). The extension sent your environment variable names to the attacker, so they know which ones exist.

Revoke at the source, not just in the file. A copied key works until the provider kills it. Our guide on rotating API keys after an AI coding tool breach and finding every copy has the per-provider steps and search commands for leftover copies, and the first hour after an API key leaks covers order of operations. Then check usage and billing pages from October 29 on.

If the key was not on your machine, Cursor's check reports it as not impacted, and you do not need a full rotation for this incident. Updating the extension is enough.

Step 4: Make the next bad extension update less likely to reach you

Extensions run with your user account's access to your files, SSH keys and environment. This incident needed no click from the victim: the update installed, the editor loaded it, and the code ran. Things that would have helped:

Install cooldown. Cursor's extension docs describe extensions.installCooldownHours, which delays installs and updates until a version has been public for that many hours, and a team setting (Marketplace Install Cooldown) that admins can enforce. The bad build was live for about eleven hours, so a cooldown of a day would have skipped it. In VS Code, extension auto update can be turned off or set to a delay as well.
Fewer extensions. Remove what you do not use. Each one is code that runs as you.
Allowlist on teams. Cursor supports allowed publishers or extension IDs and, for enterprise teams, required Open VSX signature verification. Cursor's own docs note an ID like publisher.extension can point to different code on different marketplaces.
Keep production secrets off the laptop. Put production keys in your host's environment settings, not in a local .env. Use separate development keys with low limits locally, and prefer short-lived tokens. Least-privilege keys shows how to scope them.
Do not export keys in your shell profile. A key in .zshrc is visible to every process you start, including every extension.
Treat AI tool plugins like dependencies. The same thinking applies to MCP servers in Cursor and Claude Code: pin, review, and limit what each one can reach.

Common mistakes

Uninstalling the extension and calling it done. The LaunchAgent, scheduled task and retry loop survive.
Checking only the version number. A real 2.1.312 exists, and the tampered build kept normal version numbers. Check for the key and the files.
Removing the key with grep -v and losing a real key on the same line.
Rotating from the infected machine before it is clean.
Deleting keys from .env without revoking them at the provider.
Running "fix" scripts from social posts instead of the ones in Cursor's notice.

Checklist

Copy-paste prompt for your AI coding tool

Paste this into Cursor or Claude Code to build a rotation list. It asks for names only. Never paste secret values into a chat, and do not let the tool print them.

I need to rotate credentials after a possible compromise of this machine. Without printing any secret values, list: 1) every .env style file in this project and its variable names, 2) every third party service those variables belong to (database, Supabase, Stripe, Clerk, AI providers, email, storage, analytics), 3) any secret hardcoded in source, config, MCP or agent settings files, 4) where each one is also set in production (hosting env vars, CI secrets). Output a table with service, variable name, file path, and where to revoke it. Do not change any files.

Sources

Questions

Was I affected by the malicious Claude Code extension?

Cursor says you are in scope if you installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code Extension Marketplace on macOS or Windows between about 2:27am and 1:35pm PT on October 29, 2026. Its test is simple: if the attacker's public key, labeled svc-telemetry, is in your SSH authorized_keys file, the machine is impacted. If it is not there, Cursor's own check reports the machine as not impacted.

Was the official Claude Code extension or npm package compromised?

Anthropic says no. Its staff said a malicious actor used access to Cursor's marketplace to publish a tampered copy, that Anthropic did not build or publish it, and that its official channels were not affected. Socket found no record of 2.1.313 on Open VSX or npm. Users of the Microsoft VS Code Marketplace, Open VSX or the Claude Code command line were not named as affected by Cursor or Anthropic.

Is uninstalling or updating the extension enough?

No. Cursor says the payload drops standalone persistence scripts that keep running after the extension is gone: a LaunchAgent on macOS, a scheduled task or Startup script on Windows, plus a key file and a retry loop. You have to remove the key, the persistence and any tunnel processes, which Cursor's remediation scripts do.

Did the attacker get my secrets?

Cursor says the extension sent host details, including the names of your environment variables (not their values, per Cursor's list), to the attacker, and that on most machines the SSH step failed because it needs admin rights, so the attacker could not log in through the tunnel. Cursor still tells affected users to rotate credentials and sessions the machine could reach, because the backdoor could have allowed later access. If the key was on your machine, rotate.

How do I stop the next bad extension update?

Set an install cooldown so new extension versions wait a few hours before they install (Cursor has extensions.installCooldownHours and a team-wide setting), keep the extension list short, restrict installs to an allowlist on teams, and keep long-lived production secrets off the laptop you code on.