Tampered Claude Code Extension in Cursor's Marketplace Tried to Install an SSH Backdoor — Check for the svc-telemetry Key

If you installed or updated the Claude Code extension from Cursor's marketplace on 29 October 2026, check your machine now — uninstalling the extension alone may not be enough. Cursor's own security notice reports that malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension were distributed through the Cursor VS Code Extension Marketplace between about 2:27am PT and 1:35pm PT on 29 October 2026, and that the code tried to install a persistent SSH backdoor, add an attacker-controlled SSH key, and send host details to an attacker server. Cursor states plainly: "These malicious versions of the extension were not developed by Anthropic." The notice was updated on 30 October 2026. This article follows Cursor's wording only — where Cursor does not say something, this article says so rather than filling the gap from secondary coverage.

Illustration generated for INORYVA — not a real person, product screen, or place.

What was distributed, and for how long

Both versions — 2.1.312 and 2.1.313 — were malicious, for Windows and macOS. That resolves a conflict in early secondary coverage, some of which named only one version: Cursor's own notice, as updated on 30 October, names both, and this article follows Cursor. The window was about 2:27am PT to 1:35pm PT on 29 October 2026 — roughly eleven hours, though Cursor gives the clock times rather than a duration, and this article does the same. The notice says the malicious versions do not affect other extensions from cursor.com/marketplace, Grok Bot, Grok, or other SpaceXSI products. How the tampered versions got into the marketplace is not stated in Cursor's notice, and this article does not guess: Cursor's notice does not say how it happened.

No affected-user count appears in Cursor's notice. A figure of "at most 5,000 users" circulated in secondary coverage; it is not stated by Cursor and is not presented here as fact. If you used the extension from the Cursor marketplace on 29 October, assume you may be affected and run the checks below regardless of any count.

What the malicious code tried to do

According to Cursor, the code ran on install and attempted to install a persistent SSH backdoor. It collected and reported host and user information — hostname, username, operating system, architecture, home directory path, environment variable names, working directories, the configured Git email, and the public IP address — and attempted to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel. Persistence was installed via a LaunchAgent on macOS or a scheduled task running as SYSTEM with a startup-script fallback on Windows, with background scripts retrying roughly every 60 seconds.

Cursor adds an important qualification. Outside highly unusual cases where Cursor ran with admin privileges, the step of turning on the local SSH service would fail because of errors in the malicious code, and turning on local SSH needs admin rights the extension does not have on most hosts — so on those hosts, Cursor says, the attacker could not have logged in through the tunnel. But the key was still added, persistence was still installed, and host details were still sent. Cursor's instruction stands regardless: "Follow the remediation steps below regardless." The attacker server no longer functions — Cursor says it worked with the cloud provider to take it offline — but a dead server does not undo a key left in authorized_keys.

Illustration generated for INORYVA — not a real person, product screen, or place.

What Cursor did

Cursor says it removed the malicious version immediately, blocked further distribution, shut down the whole marketplace "out of an abundance of caution", audited it and found no other extensions tampered with, rotated keys, rebuilt the marketplace, brought it back online, and took the malicious server offline. The notice lists indicators of compromise, including the attacker endpoint 134.209.82.225 (defanged in the notice) and a beacon address on port 8099, plus file paths for the persistence mechanisms on macOS and Windows. The scope section of the notice names macOS and Windows only; Linux appears only in indicator file paths, so this article does not claim Linux users were affected.

What to do: the checks and the cleanup

Cursor's remediation has five parts: run the validation script; search endpoint, network and extension telemetry for indicators; isolate hosts with evidence of execution or backdoor activity; remove the unauthorised SSH key, persistence mechanisms and running tunnel processes, and assess whether to rebuild the machine; and rotate credentials and sessions from a trusted system. The key sentence for every affected user is this one, from Cursor: "Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running." Do not stop at uninstalling.

The quick check Cursor gives for macOS is: grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted". On Windows, PowerShell checks of $HOME\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for svc-telemetry are the equivalent. The unauthorised key is labelled svc-telemetry. Cursor also provides remediation scripts — remediate-macos.sh, run as the affected user and not as root, and remediate-windows.ps1, run in PowerShell as Administrator — which remove the extension, persistence, tunnel processes and attacker key, and exit with a non-zero status if anything remains. Run the scripts from Cursor's notice itself, not from a copy pasted from social media, and rotate credentials from a trusted system afterwards.

Illustration generated for INORYVA — not a real person, product screen, or place.

Why this matters beyond Cursor

Extension marketplaces are trusted infrastructure: developers install code that runs with real privileges, on the strength of the marketplace's name and the publisher's name. Here both were borrowed — the extension carried Anthropic's name and was not built by Anthropic, and it reached users through Cursor's own marketplace. The incident is a reminder that the supply chain for developer tools is a target, that version numbers and publisher names can be spoofed inside a trusted store, and that the fix for a compromised extension is incident response, not just an uninstall. If your team used Cursor's marketplace on 29 October, treat the check above as mandatory, not precautionary — and check the shared machines and CI runners too, not only laptops.

Key Takeaways

• Malicious versions 2.1.312 AND 2.1.313 of the Anthropic.claude-code extension were in Cursor's marketplace from about 2:27am to 1:35pm PT on 29 October 2026, for Windows and macOS. They were not developed by Anthropic.
• The code tried to install a persistent SSH backdoor, add an attacker-controlled key labelled svc-telemetry, enable local SSH, open a reverse tunnel, and send host details to an attacker server (now offline). On most hosts the login step would have failed without admin rights — but the key and persistence remained.
• Cursor removed the versions, shut down and rebuilt the marketplace, audited it, and rotated keys. How the tampered versions got in is not stated in Cursor's notice; no affected-user count is stated there either.
• Uninstalling is not enough: check for the svc-telemetry key in authorized_keys, run Cursor's validation and remediation scripts from the notice itself, remove persistence and tunnel processes, and rotate credentials from a trusted system.
• Scope is macOS and Windows as named in the notice. If your team touched the extension on 29 October, check every machine — including shared and CI systems.

Conclusion

The fastest response to this incident is a five-minute check, and the slowest is assuming an uninstall fixed it. Run the svc-telemetry check, run Cursor's remediation from the official notice, and rotate credentials. Then keep the lesson: in a marketplace, a familiar name is not a guarantee, and the tools that build your software deserve the same suspicion you would give any other software you install.

Sources

• Cursor, "Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace" (updated 30 Oct 2026, 11:30am PT; versions, window, payload, caveats, remediation steps and scripts, attacker endpoint): https://cursor.com/blog/claude-code-extension-security-notice