Fake Claude Code extension on Cursor planted SSH backdoor: how to check and what to do
A tampered Claude Code extension (2.1.312 and 2.1.313) on the Cursor Marketplace tried to install an SSH backdoor on up to 5,000 developers' machines. Here's how to check your computer and clean up.
If you use the Cursor code editor with the Claude Code extension, you should check your computer today. A tampered version of the extension was published on Cursor’s extension marketplace on October 29, 2026, and it tried to plant a hidden SSH backdoor on developers’ machines. Cursor says up to 5,000 users may have been affected. Here is what happened, how to check, and what to do.
What happened?
Claude Code is Anthropic’s AI coding assistant. It is available as an extension for VS Code and editors based on it, like Cursor. On October 29, a malicious version of the extension, 2.1.313, appeared on the Cursor Marketplace under Anthropic’s real extension ID (anthropic.claude-code). Cursor later added 2.1.312 to its list of affected versions too.
According to Cursor, “Anthropic did not develop this version.” Cursor says an attacker used access to its marketplace to publish the tampered version. The bad version was live for roughly 11 to 12 hours, from about 2:27 a.m. to 1:35 p.m. Pacific Time.
Who is affected?
- Affected: people who installed or auto-updated to Claude Code 2.1.312 or 2.1.313 from the Cursor Marketplace on Windows or macOS during that window.
- Not affected: people who got the extension from the Microsoft Visual Studio Marketplace, Open VSX or npm. According to reports, Microsoft and Anthropic say the malicious version was never published on those channels.
- Anthropic’s systems: Anthropic says its own systems and employee laptops were not compromised.
Cursor says it will contact affected users directly.
What did the malware do?
According to security researchers and Microsoft’s analysis, as reported by The Hacker News, the hidden code:
- Added the attacker’s SSH key to your
~/.ssh/authorized_keysfile, labeled “svc-telemetry”. This could let the attacker log in to your computer remotely. - Tried to turn on SSH and open a “reverse tunnel” to the attacker’s server. This step usually needs admin rights, so it probably failed on most machines.
- Set up persistence so it would run again after a restart: a scheduled task on Windows, a LaunchAgent on macOS, or a crontab entry on Linux.
- Sent information about your computer to the attacker, including your public IP address, computer name, username, operating system, Git email, and the names (not values) of up to 40 environment variables that looked like secrets.
No further malware downloads have been seen so far.
Uninstalling or updating the extension does not remove files the malware wrote outside the extension folder. You need to check and clean up manually.
How to check if you were affected
- Check your extension version. In Cursor, open the Extensions panel and look at Claude Code. Did you have 2.1.312 or 2.1.313 around October 29?
- Look for the attacker’s SSH key. Open
~/.ssh/authorized_keys(on Windows,C:\Users\YourName\.ssh\authorized_keys) and search for svc-telemetry. - Check for strange startup items. Look for unknown scheduled tasks (Windows Task Scheduler), LaunchAgents (macOS
~/Library/LaunchAgents), or crontab entries (Linux). - Check your network logs for connections to the IP address 134.209.82.225.
What to do if you were affected
- Disconnect the computer from the network if you find signs of the malware.
- Save evidence first if you work at a company, then tell your security team.
- Remove the bad SSH key and any unknown startup entries or scripts.
- Update the extension to 2.1.314, the clean version.
- Rotate your secrets from a different, trusted device: API keys, cloud credentials, Git tokens and anything stored in environment variables.
- Sign out of active sessions on services like GitHub and your cloud provider.
- Consider a full rebuild of the machine if you’re unsure it is clean.
What Cursor did
According to reports, Cursor removed the bad version, blocked further downloads, took its marketplace offline, checked access, rotated its keys, and rebuilt the marketplace before bringing it back. It says no other extensions were tampered with.
Why this matters for developers
This is a supply chain attack: instead of hacking you directly, attackers poison a tool you already trust. AI coding tools are attractive targets because they often run with access to your code, terminal and secrets. We saw a similar risk in the AGENTS.md attack on AI coding agents, and in the recent ChatGPT shared link flaw.
Good habits help: turn off automatic extension updates for critical tools, keep secrets out of plain environment variables where possible, and use short-lived credentials.
Frequently asked questions
Which Claude Code versions were malicious?
Versions 2.1.312 and 2.1.313 distributed through the Cursor Marketplace. Version 2.1.314 is the clean update.
I use VS Code, not Cursor. Am I affected?
According to Microsoft and Anthropic, the malicious version was never published on the Microsoft Visual Studio Marketplace, Open VSX or npm. If you installed from those, you should not be affected.
Is uninstalling the extension enough?
No. The malware could write files outside the extension, like an SSH key and startup tasks. You need to remove those manually and rotate your secrets.
Was Anthropic hacked?
Anthropic says its systems and employee laptops were not compromised. Cursor says the attacker used access to Cursor’s marketplace to publish the tampered version.
Disclosure: AI tools, including Claude, helped write this article.
