Claude Code extension backdoor on Cursor: how to check if you were affected and clean up

If you use Cursor and installed or updated the Claude Code extension on October 29, you should check your machine. A tampered version of the extension tried to plant a hidden SSH backdoor on developers’ computers. This guide explains who was affected and gives step-by-step checks. For the full story, see our earlier report.

What happened?

• The bad version: Claude Code extension 2.1.313 (published as anthropic.claude-code).
• How long: about 11 hours on October 29, 2026, between roughly 2:27 a.m. and 1:35 p.m. Pacific time.
• Who: Cursor says at most 5,000 users were affected.
• Source: Cursor says the version was served through its own extension marketplace and “was not developed by Anthropic”.
• The fix: a clean version, 2.1.314, is available and Cursor asks everyone to update.

Early reports also pointed at the Open VSX registry, but later reporting says Cursor’s marketplace was the only source of the malicious version, and security researchers still disagree on some details. The extension in Microsoft’s VS Code Marketplace and the Claude Code command-line tool are not reported as affected.

What did the malware do?

The malicious code ran as soon as the extension loaded, without you clicking anything. According to security researchers at Phorion and Cursor’s notice, it:

• Added the attacker’s SSH key to your authorized keys file, labeled svc-telemetry.
• Opened an outbound SSH tunnel to the attacker’s server, retrying about every minute.
• Set up persistence so it survives reboots: a startup file on macOS, a cron entry on Linux, and a scheduled task called SysMon (or a Startup folder entry) on Windows.
• Sent the attacker your hostname, username, operating system, home folder, Git email and public IP address, plus the names (not the values) of up to 40 environment variables that look like keys, tokens or passwords.

The good news: Cursor says turning on SSH needs administrator rights that the extension lacks on most Mac and Windows machines, so on those the attacker likely could not log in. Cursor also worked with the hosting provider to take the attacker’s server offline. Even so, researchers warn that you should not assume you are safe if you ran the bad version.

Step 1: Check your extension version

In Cursor, open the Extensions panel, find Claude Code and check the version. You can also look in the extensions folder for a folder named anthropic.claude-code-2.1.313 followed by your platform name.

• macOS or Linux: ls ~/.cursor/extensions | grep claude-code
• Windows (PowerShell): dir $env:USERPROFILE\.cursor\extensions | findstr claude-code

If you only see 2.1.314 or an older version such as 2.1.312, you likely never had the bad one. If you see 2.1.313, continue.

Step 2: Check your SSH authorized keys

Look for an entry labeled svc-telemetry.

• macOS or Linux: grep -n "svc-telemetry" ~/.ssh/authorized_keys
• Windows: follow the steps in Cursor’s security notice, as the file location can differ.

Any match is a red flag. Don’t just delete it and move on, because other parts of the malware may still be running.

Step 3: Look for persistence

• Windows: check for a scheduled task named SysMon (schtasks /query /tn SysMon) and unfamiliar items in your Startup folder.
• Linux: run crontab -l and look for unfamiliar entries that run at reboot.
• macOS: check ~/Library/LaunchAgents for items you don’t recognize, especially ones with Apple-style names.

These commands are examples to help you look. For exact cleanup commands and scripts, use the ones Cursor published in its official security notice, which include scripts for macOS and Windows.

Step 4: If you find anything

1. Don’t rely on uninstalling the extension. The malware drops separate scripts that keep running.
2. Isolate the machine from your network and consider rebuilding it.
3. Run Cursor’s cleanup scripts and update the extension to 2.1.314.
4. Rotate credentials the machine could reach: cloud keys, API tokens, Git and SSH keys, and passwords. Do this from a different, trusted device.
5. Check SSH logs for logins from localhost that used the svc-telemetry key, to see if anyone connected.

If your credentials may have been exposed, our data breach checklist walks through the basics.

How to lower your risk next time

• Keep secrets out of environment variables on your laptop where you can, and use a secrets manager.
• Install fewer extensions and remove ones you don’t use.
• Be aware of auto-updates. One researcher noted that this was the real extension from a real publisher, so checking the publisher name would not have helped.
• Audit your SSH keys now and then, and watch for tools that add keys without your knowledge.

Frequently asked questions

Which Claude Code extension version was malicious?

Version 2.1.313, which was available in Cursor’s marketplace for about 11 hours on October 29, 2026. Version 2.1.314 is the clean replacement.

Am I affected if I use VS Code or the Claude Code terminal tool?

Reports say the extension in Microsoft’s VS Code Marketplace and the command-line tool were not affected. The malicious version came through Cursor’s marketplace.

Is uninstalling the extension enough?

No. The malware can leave scripts and an SSH key behind. Follow Cursor’s cleanup instructions and rotate any credentials the machine could access.

Was this made by Anthropic?

No. Cursor said the malicious version was not developed by Anthropic.

Sources

• Claude Code extension poisoned with persistent SSH backdoor (Help Net Security)
• Malicious Claude Code extension on Cursor planted SSH backdoors (BleepingComputer)
• Trojanized Claude Code extension hit up to 5,000 Cursor users (AI Weekly)
• Cursor security notice on the Claude Code extension
• Phorion analysis of the compromised extension