Malicious versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension went out through Cursor's extension marketplace on October 29 and planted an SSH key and a persistent tunnel on Macs and Windows PCs. Cursor has pulled them and published a check and cleanup scripts. Anthropic hasn't explained how its account was used.
If you use Claude Code inside Cursor, check your machine today. On October 29, between about 2:27 a.m. and 1:35 p.m. Pacific, Cursor’s extension marketplace served a tampered copy of Anthropic’s Claude Code extension. Cursor’s security notice says versions 2.1.312 and 2.1.313 for macOS and Windows were “not developed by Anthropic” and tried to install a persistent SSH backdoor. Cursor extensions update on their own by default, so you may have received it without clicking anything.
What happened
According to Ars Technica, the bad build was published through Anthropic’s own verified account on the Cursor marketplace, which is why it replaced the real extension in place. Independent researcher Kevin Beaumont and security firm Phorion both said so. Nobody has said how the attacker got into that account. Ars reports Cursor put the exposure at “at most 5,000 users.” When Ars published on October 30, Anthropic had not warned its customers.
Confirmed by Cursor, the malicious code:
- Sent your machine’s details to the attacker: hostname, username, OS, home folder path, environment variable names, working folders, your Git email and your public IP.
- Added the attacker’s SSH key to your
authorized_keysfile, labeledsvc-telemetry. - Installed persistence: a LaunchAgent on macOS, a scheduled task on Windows, and background scripts that retried a reverse SSH tunnel about every 60 seconds.
Two things limit the damage. Turning on the SSH service needs admin rights, so on most Macs and PCs that step failed and the attacker could not log in through the tunnel. And Cursor worked with the hosting provider to take the attacker’s server offline. Phorion’s technical write-up found the macOS code had a bug that skipped the SSH step entirely for standard users. Both say the key, the persistence and the data upload still happened.
Cursor says it removed the versions, shut down and rebuilt its marketplace, rotated its own keys and found no other tampered extensions. Phorion says the payload also has a Linux path, and Cursor’s indicator list includes Linux file paths, though its notice names only macOS and Windows.
What to do now
1. Run the check. On a Mac or Linux machine, in Terminal:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"Windows users have a PowerShell version in Cursor’s notice.
2. If the key is there, run Cursor’s cleanup script. The notice links remediate-macos.sh (run as your normal user, not root) and remediate-windows.ps1 (run as administrator). Cursor warns that uninstalling the extension may not be enough, because the payload leaves standalone scripts running.
3. Rotate credentials from a different, clean machine. That means GitHub and Git hosting tokens, cloud keys, API keys and any session the affected laptop could reach. The attacker only took environment variable names, but Cursor says that does not rule out later access through the backdoor.
4. If you run a team, search your fleet. Cursor’s notice lists file hashes, the attacker IP and the key fingerprint for your endpoint tools.
What it means
An AI coding extension runs with your full user permissions: your source code, your SSH folder, your tokens. This attack needed no exploit. It needed control of one trusted publisher account and an auto-update setting most people never change. If you run agent extensions in Cursor or VS Code at work, turn off auto-update for them and move to new versions on purpose, a day after release. The same logic applies to the tools these plans sell, like Claude Ultra’s longer agent sessions and Claude Duet: the more an agent can do on your laptop, the more a poisoned update can do. For how scoped agent credentials limit that blast radius, see 1Password for agents. Cursor users weighing the bundled plans can read our note on Cursor’s X subscription.