Claude Code Extension Backdoor on Cursor: How to Check, Clean Up and Harden

On October 29, 2026, a tampered copy of Anthropic’s Claude Code extension was served through Cursor’s extension marketplace for about 11 to 12 hours.

Versions 2.1.312 and 2.1.313 planted an SSH backdoor on up to 5,000 developer machines, and version 2.1.314 is the clean release to update to.

This guide shows exactly how to check if you were hit, how to clean up, what to rotate, and how to lock down extension auto-updates in Cursor and VS Code.

What Happened

Cursor is an AI code editor built on VS Code. It runs its own extension marketplace, and many Cursor users install Anthropic’s Claude Code extension from it.

On October 29, 2026, a maliciously modified build of that extension appeared in Cursor’s marketplace under Anthropic’s real extension id, anthropic.claude-code. It was not a look-alike fake. Because it carried the official id, editors with auto-update turned on pulled it in without any user action.

According to Cursor’s security notice, the bad versions were live from about 2:27am to 1:35pm Pacific time (roughly 09:27 to 20:35 UTC). Cursor says at most 5,000 users were affected and that it will contact them directly.

Cursor removed the versions, blocked distribution, shut its marketplace down as a precaution, rotated its keys, and later reinstated the marketplace after finding no other tampered extensions.

Anthropic says it was not a breach of its own systems.

Anthropic’s Felix Rieseberg wrote that “it wasn’t a compromise of Anthropic’s systems or employee laptops” and that “the versions on our official channels are not affected and this only impacts Cursor users.” Anthropic security engineer David Dworken said a malicious actor used their access to Cursor’s marketplace to publish the tampered version.

Anthropic did not publish a separate formal advisory page at the time of writing. Its statements came through posts by its staff, and Cursor’s notice is the main technical advisory.

How the attacker got publishing access has not been explained by either company. Early reports also said Open VSX was compromised, but that was later corrected. Socket found no sign the malicious build ever reached Open VSX.

Who Is Affected (and Who Is Not)

If you only use Claude Code in the terminal, you are fine. Still, it is good practice to keep the CLI up to date. See how to install or update Claude Code on Windows, Mac and Linux.

What the Backdoor Did

Researchers at Phorion found code injected at the very top of the extension’s extension.js. It ran as soon as the editor loaded the file, before the extension even activated. No click was needed.

• It added an attacker SSH key, labeled svc-telemetry, to your ~/.ssh/authorized_keys file.
• It tried to turn on the local SSH server and open a reverse SSH tunnel to the attacker’s server at 134.209.82.225.
• It installed persistence: a LaunchAgent on macOS, a scheduled task named SysMon (with a Startup folder fallback) on Windows, and an @reboot cron entry on Linux.
• It dropped standalone scripts that retry the tunnel about every 60 seconds, even after the editor closes.
• It sent host details over plain HTTP: public IP, hostname, username, OS, home and working folders, Git email, and the names (not values) of up to 40 environment variables that look like secrets.

There is some good news. Cursor says bugs in the malicious code meant the SSH step generally failed without admin rights, and on macOS a faulty check often kept SSH from being enabled. Cursor also says the attacker server is now offline.

But the key, the persistence files and the host report may still have landed, so you must still check and clean up.

How to Check Your Installed Version

Start by finding out which version of the extension you have, and whether you ever had a bad one.

1. Open Cursor and go to the Extensions view (Ctrl+Shift+X on Windows and Linux, Cmd+Shift+X on macOS).
2. Search for Claude Code and click the Anthropic extension. The version number shows on its details page.
3. If it shows 2.1.312 or 2.1.313, treat the machine as possibly compromised and go to the next section.
4. Check the extensions folder too, because old version folders can remain. On macOS or Linux, run:

   ls -1d ~/.cursor/extensions/anthropic.claude-code-* 2>/dev/null

   On Windows PowerShell, run:

   Get-ChildItem "$HOME\.cursor\extensions" -Directory -Filter "anthropic.claude-code-*"

5. Any folder starting with anthropic.claude-code-2.1.312 or anthropic.claude-code-2.1.313 is a red flag.
6. For regular VS Code, run code --list-extensions --show-versions or look in ~/.vscode/extensions. VS Code installs were not affected, but this confirms you are on 2.1.314 or later.

Optional extra check on macOS or Linux: hash the extension file and compare it with the malicious payload hash from Cursor’s notice.

shasum -a 256 ~/.cursor/extensions/anthropic.claude-code-2.1.31[23]-*/extension.js 2>/dev/null
# Malicious extension.js SHA-256:
# ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15

How to Check if Your Machine Was Compromised

The version check tells you if you had the bad build. This check tells you if the backdoor actually landed. Cursor published these one-line checks.

macOS (and Linux, same command):

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Windows (PowerShell):

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

Cursor did not publish a Linux-specific command, but the same grep works on Linux. Also look for the persistence files:

# macOS
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk 2>/dev/null
ls -la "$TMPDIR"/.stk_* 2>/dev/null

# Linux
ls -la ~/.config/.smt ~/.config/.smtk /tmp/.stk_* 2>/dev/null
crontab -l | grep -n "\.smt"

# Running tunnel processes (macOS and Linux)
pgrep -fl "autossh|134.209.82.225"

On Windows, open Task Scheduler and look for a task named SysMon, and check %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ for sysmon.cmd.

If the key is found, also check your SSH logs for logins from 127.0.0.1 or ::1 using that key. Phorion notes that such logins mean an operator actually got in.

How to Clean Up an Affected Machine

Warning: Do not just uninstall the extension. The backdoor scripts live outside the extension folder and keep running.

1. Disconnect or isolate the machine from sensitive networks (VPN, production). Keep evidence if your company has a security team.
2. Download Cursor’s cleanup script from Cursor’s security notice. On macOS it is remediate-macos.sh. On Windows it is remediate-windows.ps1.
3. macOS: run it as your normal user, not root, from the folder where you saved it:

   bash remediate-macos.sh

4. Windows: open PowerShell as Administrator in that folder and run:

   powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1

5. The scripts remove the extension, persistence, running tunnel processes and the attacker key. They exit with a non-zero code if anything remains. If that happens, remove the leftover items by hand using the IOC table below.
6. Linux: no official script was published. Back up your crontab first (crontab -l > ~/crontab-backup.txt), then remove the @reboot line pointing to ~/.config/.smt, delete ~/.config/.smt, ~/.config/.smtk and /tmp/.stk_*, kill any ssh or autossh tunnel to 134.209.82.225, and delete the svc-telemetry line from authorized_keys.
7. Turn off remote login if you did not use it before. On macOS that is System Settings, General, Sharing, Remote Login. On Windows, check whether the OpenSSH Server service was added and disable it if you do not need it.
8. Re-run the check commands to confirm the key and files are gone.
9. Reinstall Claude Code 2.1.314 or later from the marketplace.
10. Consider a full rebuild if you saw signs of a real login or your machine holds very sensitive access. Cursor and Microsoft both say to assess this.

What to Rotate

Cursor’s advice is broad: rotate all credentials and sessions reachable from an affected host, and do it from a trusted system. The backdoor only sent environment variable names, but an SSH backdoor could allow later access to anything on the machine. Here is a practical order.

Tip: When rotating your Anthropic key, also review your usage for spend you do not recognize. The Claude Console Cost page, grouped by API key, is the quickest place to spot that.

How to Harden Extension Auto-Updates

Auto-update is why this spread so fast: the bad build had the official id, so editors trusted it. You can trade a little convenience for a lot of safety.

In VS Code

1. Add a delay. VS Code has extensions.autoUpdateDelay, in hours. The default is 12, and 0 installs updates at once. A 12 to 48 hour delay gives the community time to catch a bad release.
2. Or turn auto-update off globally. Run the command Disable Auto Update for Extensions from the Command Palette, or set "extensions.autoUpdate": false.
3. Or turn it off per extension. Right-click the extension in the Extensions view and untick Auto Update. This is a good middle ground for high-privilege extensions like AI agents.
4. Pin a known-good version. Right-click the extension, choose Install Another Version, and pick the one you trust.
5. Allow-list extensions. The extensions.allowed setting blocks every extension not on your list. Teams can push it with enterprise policy.
6. Keep signature checks on. VS Code verifies Marketplace signatures at install. Do not turn off extensions.verifySignature.

In Cursor

1. Open your user settings.json (Command Palette, then Preferences: Open User Settings (JSON)).
2. Add these two lines. Cursor staff confirmed on the Cursor forum that the setting works locally.

   {
     "extensions.autoUpdate": false,
     "extensions.autoCheckUpdates": false
   }

3. Check for updates by hand once a week, read the release notes, and wait a day or two before installing a new build of an agent extension.
4. For managed Macs, Cursor’s MDM profile supports AllowedExtensions to limit what can be installed. As of mid-2026, Cursor said extension auto-update was not yet an MDM policy, so teams push the settings above in a managed settings.json instead.
5. Remove extensions you no longer use. Every installed extension runs with your user’s full permissions.

Note that update.mode in Cursor controls only the Cursor app updater, not extensions. If you are weighing editors after this, my Cursor vs Windsurf vs Claude Code vs Cline comparison may help.

Indicators of Compromise

These come from Cursor’s notice and Phorion’s analysis. Share them with your security team.

Note: Cursor notes that calls to ifconfig.me and api.ipify.org are normal services and not an indicator on their own.

My Take

This is a clear reminder that AI coding extensions are among the most powerful software on a developer’s machine. They read your code, run commands and often hold API keys. When a trusted id is hijacked in any marketplace, auto-update turns it into an instant, silent install.

Both companies moved fast, and the buggy malware limited the damage. Still, “probably fine” is not good enough for SSH access. Run the one-line check today.

If you are clean, update to 2.1.314 and add an update delay or a per-extension auto-update off switch for agent tools. If you find the key, clean up and rotate from another machine.

It is a few hours of work that can save you from a much bigger problem. For sensitive repos, you can also run agent sessions away from your laptop with Claude Code on the web.

Troubleshooting: Common Problems and Fixes

The grep says “No key found” but I had 2.1.313. The SSH step often failed without admin rights. Still run the file checks for .smt, .smtk and the LaunchAgent or SysMon task, because persistence and the host report could land even if the key step failed.

The remediation script exits with an error. It exits non-zero when something remains. Re-run the checks, remove leftover items by hand using the IOC table, and run the script again.

“Permission denied” on Windows. The Windows script needs an Administrator PowerShell window, because the SysMon task tries to run as SYSTEM.

The macOS script asks for root. Run it as the affected user, not with sudo, as Cursor instructs.

systemsetup shows an admin error on macOS. That is expected for standard users. It is the same bug that made the malware fail on many Macs.

My crontab lost other jobs. Phorion warns that the malicious cron logic can wipe existing jobs on repeat runs. Restore from your backup.

The Cursor marketplace will not load. Cursor took the marketplace offline during the incident and later reinstated it. If it is down again, wait and retry, or check Cursor’s status and notice pages.

Frequently Asked Questions

Which Claude Code extension versions were backdoored?

Versions 2.1.312 and 2.1.313 of Anthropic.claude-code, served through the Cursor marketplace for macOS and Windows on October 29, 2026. Version 2.1.314 is the clean release Cursor asked users to update to.

Was regular VS Code affected?

No. Microsoft says the bad build was never on the Visual Studio Marketplace, and Anthropic says its official channels, including VS Code and Open VSX, were not affected.

Was Anthropic hacked?

Anthropic says no. Its staff said its systems and employee laptops were not compromised, and that an attacker used access to Cursor’s marketplace. How that access was gained has not been made public.

Does uninstalling the extension remove the backdoor?

No. The scripts and startup entries live outside the extension folder. Use Cursor’s cleanup script or remove each item by hand.

Do I need to rotate my API keys?

If the check finds the svc-telemetry key or any persistence files, yes. Rotate every credential the machine could reach, from a trusted computer. If you never had 2.1.312 or 2.1.313, you do not need to.

How many people were affected?

Cursor says at most 5,000 users, and it plans to contact them directly.

Should I turn off extension auto-updates?

For high-privilege extensions such as AI agents, it is a sensible step. In VS Code you can also keep auto-update on but add a delay with extensions.autoUpdateDelay.

Sources

• Cursor security notice: Claude Code extension
• Anthropic VS Code extension on Cursor backdoored for nearly 12 hours, Ars Technica
• Official Claude Code extension on Cursor Marketplace trojanized, The Hacker News
• Anthropic denies breach as tampered Claude Code extension hits Cursor users, The Next Web
• Claude Code extension poisoned with persistent SSH backdoor, Help Net Security
• Phorion analysis of the Claude Code extension compromise
• Cursor announcement on X
• Extension Marketplace, VS Code docs
• extensions.autoUpdate setting and MDM, Cursor Forum