Tampered Claude Code Extension in Cursor Planted an SSH Backdoor: How to Check

A tampered copy of the Claude Code extension, version 2.1.313, was available in Cursor's extension marketplace for about 11 hours on October 29, 2026. Cursor says it tried to install a persistent SSH backdoor and was not built by Anthropic. Cursor puts the exposure at up to 5,000 users. Here is what happened and how to check your machine.

What happened to the Claude Code extension in Cursor?

BleepingComputer reports that version 2.1.313 of the Claude Code extension was available from 2:27 a.m. to 1:35 p.m. Pacific Time on October 29. Cursor said: "The extension runs malicious code that attempts to install a persistent SSH backdoor." It also said the version "was not developed by Anthropic." Cursor removed it, took its whole marketplace offline to audit it and rotate access keys, and worked with the hosting provider to take the attacker's server offline.

What did the malicious code do?

Researchers at Phorion and OpenSourceMalware say the attackers added a JavaScript loader to the start of the extension's main file and left the rest of the code unchanged. It ran as soon as the extension loaded, with no action from the user. Reported behaviour:

• Collected the hostname, username, operating system, Git email and public IP address.
• Listed the names, not the values, of up to 40 environment variables that look like keys, tokens or passwords.
• Added the attacker's SSH key to the user's authorized keys file and tried to open a reverse SSH tunnel, retrying about every minute.
• Set up persistence: a startup item on macOS, an @reboot cron entry on Linux, and a scheduled task named "SysMon" or a Startup folder entry on Windows.

BleepingComputer says coding errors limited the damage. On macOS and Windows the attempt to switch on an SSH server often failed. Phorion warned that this is no defence: a Mac that already has Remote Login turned on stays exposed.

How can you check if you were affected?

1. Check the version. See whether 2.1.313 was ever installed or updated to in Cursor.
2. Look for the key. Search your authorized keys file for an entry labelled svc-telemetry. On macOS and Linux this is normally ~/.ssh/authorized_keys.
3. Check persistence. Look for the startup item on macOS, @reboot cron entries on Linux, and the "SysMon" task or Startup folder on Windows.
4. Do not rely on uninstalling. Cursor warns the payload leaves standalone scripts that keep running.
5. If you find the key, isolate the machine, run Cursor's remediation scripts, rotate credentials and sessions from a trusted device, and consider rebuilding it.

Cursor and Phorion have published check and cleanup commands and indicators of compromise, so use their instructions rather than ours for the exact commands.

What we could not confirm

How the attackers published under Anthropic's name, and whether Cursor's or Anthropic's systems were compromised, has not been explained. Early reports named Open VSX, npm and Microsoft's marketplace too, but later confirmation indicated Cursor was the only source, and one security firm disputes the Open VSX claim. We found no statement from Anthropic in the reports we read. The 5,000 figure is Cursor's maximum, and we do not know how many machines were infected or whether anyone logged in. We have not tested the payload.

Summary

Version 2.1.313 of the Claude Code extension was available in Cursor's marketplace for about 11 hours on October 29, 2026, and Cursor says up to 5,000 users could be affected. Check for the svc-telemetry SSH key and the persistence items, remember that uninstalling is not enough and follow Cursor's and Phorion's published cleanup steps.

Related articles

• GitHub Universe 2026: Copilot App, Fusion and Automations Explained for Developers and Teams
• Do You Need a Password Manager? What the UK's NCSC Advises
• More software and SaaS news