Malicious Claude Code Extension 2.1.313 in Cursor: How It Worked and What To Do

I use Claude Code every day, so when Cursor posted a security notice about a malicious Claude Code extension in its marketplace, I dropped everything and read it twice. If you use Cursor (or anything that pulls extensions from Open VSX), take five minutes and check your machine. It’s one command.

Quick answer: what happened?

#

On 29 October 2026, a trojanized build of Anthropic’s Claude Code VS Code extension, version 2.1.313, was served by the Cursor extension marketplace for roughly 11 hours. On load, it planted an attacker SSH key, installed persistence, tried to open a reverse SSH tunnel and beaconed host details to 134.209.82.225. Cursor says at most 5,000 users were affected. Anthropic did not build that version.¹

How the attack worked

#

The scary part is how ordinary it looked. The package carried the real Anthropic publisher identity, not a typosquat. StepSecurity found the malicious build was the official extension in every way except extension.js, which had a small loader (about 7 KB) inserted in front of the legitimate code.² OpenSourceMalware described it as a 66-line loader.³

No prompt, no click, no install script. Just loading the extension was enough to run the payload, and anyone with auto-update on could have pulled it silently.³

flowchart TD
  A[Cursor auto-updates Claude Code to 2.1.313] --> B[extension.js loader runs]
  B --> C[Collect host info]
  B --> D[Add svc-telemetry key to authorized_keys]
  B --> E[Install persistence]
  B --> F[Reverse SSH tunnel to 134.209.82.225]
  C --> G[POST to :8099/beacon]
  E --> F

Step by step, according to Cursor’s notice:¹

1. Recon. It collected hostname, username, OS, architecture, home directory, working directories, your global Git email, public IP, and the names of environment variables. Researchers say it grabbed up to 40 names containing words like KEY, TOKEN, SECRET, PASS, AWS or GCP. The values were not in the beacon, but the names alone tell an attacker which clouds and CI systems you use.³
2. SSH key implant. It appended an attacker-controlled ssh-ed25519 key labeled svc-telemetry (a name picked to look boring) to your ~/.ssh/authorized_keys.
3. Enable SSH and tunnel out. It tried to turn on the local SSH server and open a reverse tunnel (ssh -N -R '*:0:localhost:22') so the attacker could reach your machine from outside, past your NAT and firewall.
4. Persistence. A LaunchAgent called com.apple.sysmond on macOS; on Windows a scheduled task called SysMon that tries to run as SYSTEM, with a Startup-folder fallback. Background scripts retry the tunnel about every 60 seconds. StepSecurity also saw a cron @reboot entry in its analysis.²
5. Beacon. It POSTed host details and backdoor status over plain HTTP to port 8099.

The (small) good news

#

Turning on the SSH server needs admin rights. On most macOS and Windows machines Cursor doesn’t run as admin, so that step failed and, per Cursor, the attacker could not have logged in through the tunnel. Bugs in the malicious code made it fail too. But the key was still added, the persistence was still installed and your host details were still sent. And the attacker server has since been taken offline with help from the hosting provider.¹

Who got affected?

#

• Cursor users who installed or updated to 2.1.313 from the Cursor marketplace during the window. Cursor says that’s at most 5,000 people and it will contact them directly.¹
• The known malicious builds were macOS on Apple silicon (darwin-arm64) and Windows x64.
• Cursor says it has no evidence other versions, other extensions or the official distribution were affected, and its audit found no other tampered extensions.¹

What to do next

#

1. Check if you’re impacted

#

On macOS (or Linux):

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows (PowerShell):

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

These are Cursor’s official checks.¹ Also check which Claude Code version you have in the Extensions panel, and update to 2.1.314 or later.

2. If the key is there

#

Follow Cursor’s steps, in order:¹

1. Isolate the machine from the network.
2. Run Cursor’s remediation script. On macOS, download remediate-macos.sh and run bash remediate-macos.sh as your normal user, not root. On Windows, download remediate-windows.ps1 and run it from an Administrator PowerShell with powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1. The scripts remove the extension, the persistence, the tunnel processes and the key, and exit non-zero if anything is left.
3. Consider rebuilding the machine. A backdoor that might have been reachable is a good reason for a clean install.
4. Rotate credentials and sessions reachable from that machine (cloud keys, Git tokens, API keys, SSH keys), and do it from a different, trusted machine.
5. If you run a team, search your endpoint and network telemetry for the indicators below.

3. Lessons I’m taking from this

#

• Auto-update is a supply chain. A trusted name on a package is not a guarantee. For critical tooling, consider pinning extension versions or delaying updates by a day or two.
• Watch your authorized_keys. It’s one small file and almost nobody looks at it. A simple file-integrity alert would have caught this.
• Keep secrets out of plain environment variables where you can. Even the names leaked here.
• Don’t run your editor as admin. That alone is what broke the tunnel for most people.

Indicators of compromise

#

Full list is in Cursor’s notice and StepSecurity’s analysis.¹²

What Cursor did

#

Cursor pulled the version as soon as it was detected, then shut the whole marketplace down as a precaution. It audited access, rotated its keys, rebuilt the marketplace and brought it back online, and worked with the hosting provider to take the attacker’s server down.¹ Questions go to security@cursor.com.

FAQ

#

Is the official Claude Code extension safe now? Version 2.1.313 has been removed, and Anthropic published 2.1.314 to Open VSX and the Microsoft marketplace.³ Update and run the check above.

I uninstalled the extension. Am I fine? Not necessarily. The payload drops standalone scripts that keep running after the extension is gone. Run the check and the remediation script.¹

Were my secrets stolen? The beacon sent environment variable names, not values.³ But if the tunnel worked on your machine (for example, Cursor running as admin), assume anything on it was reachable and rotate.

Does this affect the Claude Code CLI? The reports are about the VS Code extension package anthropic.claude-code 2.1.313 only.

Stay safe, and go grep your authorized_keys.