Key takeaways
- Cursor says version 2.1.313 of the Claude Code extension in its marketplace was malicious on October 29, from about 2:27 a.m. to 1:35 p.m. PT.
- It tried to add an attacker SSH key and open a reverse tunnel; Cursor says at most 5,000 users were affected.
- Users who installed it should check for an SSH key labeled svc-telemetry, run Cursor's remediation script and rotate credentials.
Cursor says a maliciously modified copy of the Claude Code extension, version 2.1.313, sat in the Cursor Extension Marketplace on October 29 and tried to plant an SSH backdoor on developers' machines. In its security notice, Cursor says the build was "not developed by Anthropic" and that at most 5,000 users were affected.
If you use Cursor and installed or updated the Claude Code extension that day, check your machine now. Uninstalling the extension does not undo what it did.
What the malicious build did
According to Cursor, the extension collected the hostname, username, operating system and public IP address. It then tried to add an attacker's SSH key to the user's authorized_keys file, turn on the local SSH service and open a reverse SSH tunnel back to the attacker's server. A reverse tunnel lets the attacker reach the machine from outside, even behind a home router.
It also tried to survive restarts. On macOS it used a LaunchAgent, and on Windows a scheduled task with a Startup script as backup, retrying about every 60 seconds.
Cursor adds a limit on the damage. Turning on the SSH service generally fails without administrator rights. The key, the persistence and the report back to the attacker could still happen. Security firm OpenSourceMalware, which analyzed the package, describes the code as a loader of about 66 lines added in front of the real extension code, and says it found no further payloads.
Who was exposed
Cursor puts the window at roughly 2:27 a.m. to 1:35 p.m. Pacific time on October 29. It says it found no evidence that other versions or the official distribution are affected. Cursor asks users to move to version 2.1.314.
Whether Anthropic's own channels were touched is a separate question. Socket, another security firm, found no 2.1.313 record in npm, in Open VSX's change feed or in Anthropic's public GitHub releases. Socket says that does not by itself prove anything either way. We found no statement from Anthropic.
What to do if you installed 2.1.313
Cursor's steps, in order:
- Look in
~/.ssh/authorized_keysfor a key with the commentsvc-telemetry. - Search endpoint and network logs for the indicators Cursor lists, including traffic to 134.209.82.225.
- Isolate any machine that shows signs of the payload.
- Run Cursor's remediation script:
remediate-macos.shas the affected user, not root, orremediate-windows.ps1from an elevated PowerShell. - Rotate credentials and sessions that the machine could reach, from a trusted computer.
Cursor warns that a full rebuild of the machine may be warranted. It says it is contacting affected users directly.
What Cursor did
Cursor removed the version and blocked further downloads. It shut the marketplace down for a time, rebuilt it and rotated its own keys. It also says it audited access and confirmed no other extensions were tampered with, and worked with the hosting provider to take the attacker's server offline.
Still unanswered is how the attacker got a modified build into the marketplace under Anthropic's extension name. Cursor's notice does not say. If you also want to check your setup, see our guide to fixing Claude Code in VS Code.