Direct answer: If Cursor installed or updated Anthropic.claude-code version 2.1.312 or 2.1.313 on macOS or Windows between 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, 2026, check the machine now. Cursor says those marketplace builds were maliciously modified and attempted to install a persistent SSH backdoor.[1]
Do not assume uninstalling the extension fixed the machine. The payload could leave an SSH key and standalone persistence behind, so affected hosts should be isolated, remediated with Cursor’s official script, assessed for rebuild, and have accessible credentials rotated from a separate trusted device.[1][2]
Scope matters: Cursor’s updated notice names the affected builds as
2.1.312and2.1.313from the Cursor VS Code Extension Marketplace for macOS and Windows. Cursor says it has no evidence that other versions or Anthropic’s official distribution were affected.[1]
60-second impact check
Run the command for your operating system. It searches for the unauthorized SSH key label svc-telemetry, which Cursor identifies as the clearest local impact check.[1]
macOS Terminal
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
Windows PowerShell
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }
If the result says svc-telemetry key found, disconnect or isolate that computer from normal work and continue with the response plan below.[1] Do not use the affected computer to change passwords or rotate API keys.[1]
A clean result from this one check is useful, but organizations should still review extension-install records, endpoint telemetry and network logs if the affected version may have run. Cursor’s official guidance explicitly recommends those additional checks.[1]
Who needs to act?
You should investigate if all of these are true:
- You used Cursor on macOS or Windows.[1]
- You installed or updated Claude Code through Cursor’s own extension marketplace.[1]
- The install or update happened during the October 29 exposure window.[1]
- The installed marketplace build was
2.1.312or2.1.313, or you cannot confidently prove which build ran.[1]
Users who installed Claude Code only through Anthropic’s official distribution, Microsoft’s official VS Code Marketplace or another unaffected source should not broaden this notice beyond Cursor’s stated scope. Cursor says it found no evidence that the official distribution or other versions were affected.[1]
What the malicious extension attempted
Cursor says the modified extension collected host and user details, including the hostname, username, operating system, architecture, home-directory path, environment-variable names, working directories, configured Git email and public IP.[1]
It also attempted to append an attacker-controlled key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel. Cursor says the SSH-enablement step would normally fail because it needs administrator privileges and the malicious code contained errors, but the extension could still add the key, install persistence and send host details.[1]
The persistence was designed to keep retrying independently of the extension. Independent analysis from OX Security describes a macOS LaunchAgent and a Windows scheduled task or Startup fallback, with background scripts retrying the tunnel about every 60 seconds.[2]
Cursor says the attacker-controlled server was taken offline, so the identified reverse shell and host-detail endpoint no longer function. That reduces current command-and-control risk, but it does not remove files, keys or persistence already written to a machine.[1][2]
Response checklist if the key is found
1. Isolate the computer
Disconnect the affected host from normal corporate, production and development access.[1] Preserve endpoint and network logs if an incident-response team may need them.[1]
2. Use Cursor’s official remediation script
Download the script only from Cursor’s security notice:
On macOS, Cursor says to run the downloaded script as the affected user, not as root:[1]
bash remediate-macos.sh
On Windows, open PowerShell with Run as Administrator, then run:[1]
powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1
Cursor says these scripts remove the malicious extension, persistence mechanisms, running tunnel processes and unauthorized SSH key, and return a non-zero status if something remains.[1]
3. Decide whether to rebuild the host
Script cleanup is not the same as proving that nothing else happened. Cursor’s own response steps say to assess whether the host should be rebuilt.[1]
A rebuild is the safer choice when the host held production access, signing keys, cloud administrator sessions, customer data, deployment credentials or other high-value secrets—or when the timeline and telemetry are incomplete.
4. Rotate credentials from a trusted device
Use a separate clean computer to rotate credentials and revoke sessions that the affected host could access. Prioritize:
- GitHub, GitLab and Bitbucket sessions, personal access tokens and SSH keys
- cloud-provider keys and active sessions
- package-registry tokens
- CI/CD and deployment secrets
- database and infrastructure credentials
- password-manager and SSO sessions
- API keys present in local files, shells, IDE settings or development tooling
Cursor notes that collecting only environment-variable names does not rule out later credential access through the attempted backdoor.[1]
5. Verify cleanup
Re-run the svc-telemetry check, confirm the official remediation script exits successfully, and review the official indicators of compromise in Cursor’s notice. Organizations should also search endpoint and network telemetry before reconnecting the machine.
What not to do
- Do not only uninstall the extension. The payload could leave standalone persistence running.[1][2]
- Do not rotate secrets on the suspect machine. Use a trusted system.
- Do not download cleanup scripts from reposts or random repositories. Use Cursor’s official notice.
- Do not treat every Claude Code installation as compromised. Keep the investigation scoped to the marketplace, versions, platforms and exposure window Cursor identified.[1]
- Do not assume a failed reverse tunnel means no impact. The key, persistence and host reporting could still have executed.[1][2]
Timeline
- October 29, 2026, about 2:27 a.m.–1:35 p.m. PT: Cursor says the maliciously modified extension was available in its marketplace.[1]
- After detection: Cursor removed the versions, blocked distribution, shut down and rebuilt the marketplace, rotated keys, audited other extensions and worked with the hosting provider to take the attacker server offline.[1]
- October 30, 2026, 11:30 a.m. PT: Cursor updated its notice and clarified that both
2.1.312and2.1.313were affected.[1]
FAQ
Was Anthropic’s official Claude Code distribution compromised?
Cursor says the malicious builds were not developed by Anthropic and that it has no evidence the official distribution was affected.[1]
Which versions were affected?
Cursor’s updated notice identifies Anthropic.claude-code versions 2.1.312 and 2.1.313 in the Cursor VS Code Extension Marketplace for macOS and Windows.[1]
Is uninstalling Claude Code enough?
No. Cursor and OX Security warn that standalone persistence can remain after the extension is removed.[1][2]
What is the fastest check?
Search the relevant SSH authorized_keys file for the label svc-telemetry using Cursor’s macOS or Windows command above.[1]
Is the attacker server still active?
Cursor says it worked with the hosting provider to take the identified server offline, making the reported reverse shell and host-detail endpoint nonfunctional.[1]
Should I rotate every credential?
Rotate credentials and revoke sessions accessible from an impacted host, using a trusted device. The exact scope should follow the host’s access and your incident-response policy.[1]
This article is a source-backed incident checklist, not a substitute for professional incident response. For an impacted corporate or production device, involve the organization’s security team.
Sources
[1] https://cursor.com/blog/claude-code-extension-security-notice — Security notice — malicious Anthropic.claude-code extension versions in Cursor Marketplace
> “Today we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace: Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS. These malicious versions of the extension were not developed by Anthropic.”
> “Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor.”
> “If you installed or updated to Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code Extension Marketplace on macOS or Windows between 2:27am PT and 1:35pm PT on October 29, 2026:”
> “The malicious extension appends the attacker’s public key, labeled svc-telemetry, to your SSH authorized keys.”
> “We worked with the cloud provider that was hosting it to take it offline, so the reverse shell and host detail POST are not functional.”
> “These findings concern the identified package. We have no evidence that other versions of the extension or the official distribution are affected.”
[2] https://ox.security/blog/malicious-claude-code-extension-cursor-ssh-backdoor — Malicious Claude Code Extension Installs SSH Backdoor via Cursor
> “Importantly, uninstalling the malicious extension may not be sufficient, because the payload drops standalone persistence scripts that can continue running after the extension is removed.”
> “The payload installs persistence mechanisms designed to keep the reverse SSH tunnel running independently of the extension, with background scripts retrying the connection approximately every 60 seconds.”