Claude Code Backdoor in Cursor: Check, Clean, Rotate

If you use Cursor and installed or auto-updated the Claude Code extension on 29 October 2026, check your machine now. For about 11 hours, Cursor's VS Code Extension Marketplace served a tampered build that added an attacker's SSH key, labelled svc-telemetry, to ~/.ssh/authorized_keys, installed persistence and sent host details to the attacker. Run grep -qs svc-telemetry ~/.ssh/authorized_keys. If the key is there, uninstalling is not enough: clean the machine with Cursor's script, isolate it and rotate credentials from a clean device.

Who this is for: developers who use Cursor, the security and IT teams who look after their laptops, and anyone who approves IDE extensions or AI coding agents for a team.

Independent analysis based on Cursor's security notice and remediation scripts, Anthropic's public statement, and reporting by The Hacker News, StepSecurity, Help Net Security and The Register. PlayCISO is not affiliated with Cursor or Anthropic. Facts are as reported on 30 October 2026 and may change.

What happened

Cursor's notice says the extension "runs malicious code that attempts to install a persistent SSH backdoor." According to Cursor, it:

• Reported host and user details to the attacker: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email and public IP. The Hacker News and StepSecurity say it sent the names (not values) of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP.
• Added an attacker-controlled SSH key to authorized_keys, tried to switch on the local Secure Shell (SSH) service, and tried to open a reverse SSH tunnel to 134.209.82.225.
• Persisted the tunnel with a LaunchAgent on macOS, or a scheduled task that tries to run as SYSTEM with a Startup-folder fallback on Windows. Background scripts retry the tunnel about every 60 seconds.

The loader ran as soon as the editor loaded the extension. StepSecurity says the payload "runs under plain Node.js" and needs no Claude conversation. Help Net Security reports it was an injected function at the top of the minified extension.js that runs before the extension's activate step. Jenn Gile of OpenSourceMalware told The Hacker News the bundle contained "a malicious 66-line loader inserted before the legitimate extension code," and that "anyone who has their Claude Code instance set to auto-update could have consumed the malware."

Could the attacker actually log in?

Probably not on most machines, but do not rely on that. Cursor says turning on the SSH service "requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails and the attacker could not have logged in through the tunnel." Phorion, quoted by Help Net Security, warns the backdoor still works if Remote Login is already on, or is switched on later. Cursor's own advice: "Follow the remediation steps below regardless." Cursor also says it worked with the hosting provider to take the attacker server offline, so the tunnel and the beacon no longer work.

Timeline

Am I affected?

You are in scope if you installed or updated Anthropic.claude-code from the Cursor marketplace on macOS or Windows between 2:27am and 1:35pm PT on 29 October 2026. Auto-update counts. The quickest check is the SSH key. These commands are copied from Cursor's notice.

macOS (Terminal):

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Windows (PowerShell):

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

Cursor: "If the key is found, your machine is impacted."

Deeper checks

The commands below are built from the indicators and file paths in Cursor's notice and remediation scripts. A hit on any of them means the payload ran.

macOS:

# Tampered extension on disk (the bad bundle keeps the real version number, so match on content)
grep -lF svc-telemetry ~/.[!.]*/extensions/anthropic.claude-code-*/extension.js 2>/dev/null

# Persistence and dropped files
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk 2>/dev/null
ls -la "$TMPDIR"/.stk_* /tmp/.stk_* 2>/dev/null

# Running tunnel processes
pgrep -fl '/\.stk_[0-9a-f]{10}|/\.config/\.smtk|/\.config/\.smt'

Linux: Cursor lists the affected builds as Windows and macOS only, but its indicator list also includes Linux artefacts (a cron @reboot entry running ~/.config/.smt and /tmp/.stk_<10 hex>). If you run Cursor on Linux, a quick look costs nothing:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found"
crontab -l 2>/dev/null | grep -F '.config/.smt'
ls -la ~/.config/.smt ~/.config/.smtk /tmp/.stk_* 2>/dev/null

Windows:

# Run in PowerShell (as Administrator to see every profile)
Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue
Test-Path "$env:USERPROFILE\.config\smt.cmd", "$env:USERPROFILE\.config\smtk", "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"
Get-ChildItem "$env:TEMP" -Filter .stk_* -Force -ErrorAction SilentlyContinue
Get-ChildItem "$HOME\.*\extensions\anthropic.claude-code-*\extension.js" -Force -ErrorAction SilentlyContinue | Select-String -SimpleMatch svc-telemetry -List

Across a fleet: search endpoint and network telemetry for the indicators below. Cursor's notice says to search "endpoint, network, and extension-installation telemetry."

Indicators of compromise

All from Cursor's notice unless marked. Defang before pasting into tickets.

A note on hashes: StepSecurity's early write-up labelled the fcbb327e… and 3de17229… VSIX files as 2.1.313. Cursor's updated notice files those two under 2.1.312 and lists separate 2.1.313 hashes. Use Cursor's table. Lookups to ifconfig.me and api.ipify.org are legitimate services; Cursor says "access alone is not an indicator."

What to do if you are affected

This order follows Cursor's notice, with the extra points StepSecurity and Phorion make.

1. Isolate the host. Cursor: "Isolate hosts showing evidence of payload execution or backdoor installation." If you have an incident process, open a ticket and keep evidence before cleaning up (StepSecurity: "collect evidence, then remove persistence").
2. Run Cursor's remediation script. It removes the tampered extension, the persistence, running tunnel processes and the attacker's key, and exits non-zero if anything is left. Download remediate-macos.sh and run it as the affected user, not as root:

   bash remediate-macos.sh

   On Windows, download remediate-windows.ps1, close all editors, and run it from PowerShell opened with Run as Administrator:

   powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1

   Read any script before you run it. Both are short.
3. Do not stop at uninstalling. Cursor: "Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running."
4. Rotate credentials and sessions the machine could reach, from a trusted system: source control, CI/CD, cloud, SSH and package registry tokens (StepSecurity's list), plus anything in environment variables. Cursor: "The limited env-var collection does not rule out later credential access over the backdoor."
5. Hunt for logins. Phorion (via Help Net Security) suggests checking SSH logs for logins from localhost using the svc-telemetry key. In sshd logs an accepted key shows its fingerprint, so search for 0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk. If the tunnel ever connected, StepSecurity and Phorion recommend rebuilding the machine.
6. Update the extension to a clean release. The Hacker News reports Anthropic published 2.1.314 to Open VSX and the Microsoft VS Code Marketplace; Cursor has not named a fixed version in its notice.

What this means for teams that approve IDE extensions and AI coding agents

The extension carried the real publisher ID and a real-looking version number. Publisher name checks, star ratings and "official" badges would not have caught it. Five practical lessons:

• An AI coding extension is privileged software. It runs with the developer's account on the machine that holds their SSH keys, cloud credentials and source code. Approve and monitor it like an endpoint agent, not like a colour theme.
• Know which marketplace each editor trusts. VS Code forks such as Cursor do not use Microsoft's marketplace; Help Net Security notes Microsoft's terms limit it to Microsoft's products. Your approval list should name the editor, the marketplace and the publisher, because "the Claude Code extension" means different files in different places.
• Auto-update is the delivery mechanism. Gile's point: anyone set to auto-update could have pulled it. For extensions with broad reach, pin versions on managed machines and let updates through after a short delay or review. Check what your editor supports: VS Code has settings for turning off extension auto-update and for allow-listing extensions, and forks may or may not honour them.
• Watch the things a backdoor has to touch. This one had to edit authorized_keys, create a LaunchAgent, cron entry or scheduled task, and connect to a raw IP over plain HTTP on port 8099. File-integrity alerts on authorized_keys and default-deny egress from developer machines would each have flagged it.
• Keep developer credentials short-lived. If a laptop is backdoored, short-lived, scoped tokens limit what an attacker can take. Long-lived keys in environment variables are exactly what this beacon was counting.

If you keep an AI Bill of Materials, or AIBOM, add the AI coding tools and their extension versions to it, so the next advisory is a lookup, not a hunt. See AIBOM in incident response.

Put it to work

• Agent Plugin & Skill Supply-Chain Lab: practise triaging third-party plugins, skills and MCP servers by risk (unvetted, unpinned auto-update, over-permissioned) and the control that fits.
• Identity Compromise Response Checklist: work through scope, revoke and rotate when a machine with real credentials is backdoored.
• Non-Human Identity Risk Checklist: score the API keys, CI tokens and service accounts a developer laptop can reach, and plan the move off static keys.
• AI Incident Response Checklist: a response checklist for incidents involving AI tools and agents.

FAQ

Was Anthropic hacked?

Both companies say no. Cursor's notice says the malicious versions "were not developed by Anthropic". Anthropic's Felix Rieseberg wrote on X, as quoted by The Register: "it wasn't a compromise of Anthropic's systems or employee laptops" and "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish." Neither company has said how the attacker got that access.

Which versions of the Claude Code extension are affected?

Cursor's notice, updated on 30 October 2026 at 11:30am PT, names 2.1.312 and 2.1.313 for Windows and macOS from the Cursor marketplace. Earlier reports named only 2.1.313. Cursor's remediation script notes the tampered bundle keeps the real version number, so check the file contents, not the version label. The Hacker News reports Anthropic published a clean 2.1.314.

How do I check if my machine is affected?

Run grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted" on macOS or Linux, or the PowerShell check above on Windows. Then look for the persistence files listed in the indicators table.

Does uninstalling the extension remove the backdoor?

No. Cursor says the payload "drops standalone persistence scripts that keep running." Run Cursor's remediation script, rotate credentials from a trusted machine and consider rebuilding.

Were VS Code, Open VSX or the official Claude Code install affected?

Anthropic says "The versions on our official channels are not affected, and this only impacts Cursor users." Cursor says it has no evidence other versions or the official distribution are affected. Reports disagree about Open VSX: StepSecurity and Phorion say 2.1.313 appeared there, while The Hacker News corrected its story to point at the Cursor VS Code Marketplace and Manifold Security's Ax Sharma disputes the Open VSX reports. StepSecurity says Open VSX and the Microsoft Marketplace no longer serve 2.1.313.

What data did the backdoor send to the attacker?

Hostname, username, OS, architecture, home directory, environment variable names, working directories, Git email and public IP (Cursor). The Hacker News and StepSecurity say the variable names were limited to up to 40 that contain KEY, TOKEN, SECRET, PASS, AWS or GCP: names, not values. A working backdoor could still reach the values, so rotate.

Sources

• Cursor: Security notice, malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) (29 Oct 2026, updated 30 Oct 11:30am PT), with remediate-macos.sh and remediate-windows.ps1
• The Register: Anthropic says the compromise was not on its side (quotes Felix Rieseberg's post on X)
• The Hacker News: Official Claude Code extension on Cursor Marketplace trojanized
• StepSecurity: Trojanized Claude Code extension delivered a persistent SSH backdoor
• Help Net Security: Claude Code extension poisoned with persistent SSH backdoor (Phorion and Manifold Security findings)

This article is educational guidance for security and engineering leaders, not legal advice or a forensic report. Always check Cursor's notice for the latest indicators before acting.