Skip to content

Claude Code extension in Cursor planted an SSH backdoor

On 29 October 2026 the Cursor extension marketplace served a tampered build of the Claude Code extension (anthropic.claude-code 2.1.312 and 2.1.313, Windows and macOS) for about eleven hours. Cursor says the malicious versions "were not developed by Anthropic". Anyone who installed or auto-updated the extension in Cursor that day should check for an attacker SSH key named svc-telemetry and for the persistence it set up.

Runbook card

What changes: nothing to configure. A one-day supply-chain compromise left an attacker SSH key, a reverse tunnel and a start-up task on some developer machines.
Who: people who use Cursor with the Claude Code extension and installed or updated it on 29 October 2026. No evidence that the VS Code Marketplace or Open VSX served the bad build.
By when: now. The key and the start-up task stay until someone removes them.
Do this: 1. Run the checks below. 2. Update the extension to 2.1.314. 3. If anything is found, isolate the machine, run Cursor's remediation script and rotate credentials from a clean machine.
Check: findstr /C:"svc-telemetry" "%USERPROFILE%\.ssh\authorized_keys" and schtasks /query /tn SysMon on Windows.
Source: Cursor security notice (29 October 2026, updated 30 October).

What happened

  • Cursor's notice gives the window as about 02:27 to 13:35 PT on 29 October 2026 (about 09:27 to 20:35 UTC). The Hacker News reports, citing Cursor, that up to 5,000 users installed the bad build. Cursor took its marketplace down to remove it, and version 2.1.314 replaced it.
  • A loader was added in front of the legitimate code in the extension's main JavaScript file. It ran when the editor started and when the extension's panel opened.
  • It added an attacker key with the comment svc-telemetry to authorized_keys, tried to turn on the local SSH service and opened a reverse SSH tunnel to 134.209.82.225. Cursor says enabling SSH "would likely fail on most macOS and Windows hosts" because it needs admin rights, but the key and the persistence can still be in place.
  • It set up persistence that retries about every 60 seconds: a scheduled task SysMon (with a Startup-folder fallback sysmon.cmd) on Windows, a LaunchAgent com.apple.sysmond on macOS, and a cron @reboot entry on Linux.
  • It sent host details to 134.209.82.225:8099/beacon over plain HTTP: public IP, hostname, user name, OS, home and working directories, Git email, and the names (not the values) of environment variables that look like secrets.
  • Cursor says the attacker server has been taken offline. That does not remove anything already installed.

Who is affected

You are in scope if Cursor on Windows or macOS installed or auto-updated anthropic.claude-code to 2.1.312 or 2.1.313 on 29 October 2026. People who installed the extension from the VS Code Marketplace or Open VSX are not known to be affected. The Claude Code command-line tool is not named in either report.

For teams: developer laptops often hold cloud, Git and AI tool credentials. Treat a hit as an endpoint incident, not as a plugin update.

Check

These commands only read. Run them on each machine that uses Cursor.

:: Windows (Command Prompt)
findstr /C:"svc-telemetry" "%USERPROFILE%\.ssh\authorized_keys"
findstr /C:"svc-telemetry" "%ProgramData%\ssh\administrators_authorized_keys"
schtasks /query /tn SysMon
dir /a "%USERPROFILE%\.config\smt*"
dir /a "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"

# macOS
grep svc-telemetry ~/.ssh/authorized_keys
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk
ps aux | grep -E "ssh -N -R|autossh" | grep -v grep

# Which version is installed (if the cursor command is on your PATH)
cursor --list-extensions --show-versions | grep -i claude

No output (or "file not found" and "cannot find the task") means none of these indicators is present. On a network level, look for connections to 134.209.82.225 on TCP 22 or 8099 since 29 October.

What to do if you find something

  1. Isolate the machine and keep evidence.
  2. Remove the key, the persistence and any running tunnel. Uninstalling the extension alone is not enough, because the start-up scripts keep running. Cursor publishes remediate-windows.ps1 (run from an elevated PowerShell) and remediate-macos.sh (run as the affected user); both exit non-zero if anything remains. Consider rebuilding the machine.
  3. From a clean machine, rotate the credentials and sessions that machine could reach: Git and package registry tokens, cloud and SSH keys, AI provider keys and anything listed in its environment.
  4. Update the extension to 2.1.314 and check where your editors get extensions from.

Why it matters for security

AI coding tools run with your user's rights, your keys and your network. This build came through a trusted listing under the right publisher name, and auto-update did the rest. Pin or allow-list extension versions on developer machines where you can, alert on new entries in authorized_keys and on new scheduled tasks or LaunchAgents, and keep credentials on developer laptops short-lived.

Related: our weekly AI security news and the earlier LiteLLM 1.107.0 supply-chain compromise.

Sources

Last reviewed: 31 October 2026.