On October 29, 2026, Cursor said a modified build of Anthropic's Claude Code extension sat in its extension marketplace for about 11 hours and reached at most 5,000 users. We queried the public registries ourselves, merged the indicators Cursor and the researchers published into one checklist per operating system, and explain why uninstalling the extension does not remove what it planted.
This explains reporting by
Cursor, "Security notice: malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace" (October 29, 2026). Read the original first:
https://cursor.com/blog/claude-code-extension-security-notice
In one minute #
- Cursor says a modified Anthropic.claude-code 2.1.313 was in its VS Code extension marketplace from about 2:27am to 1:35pm Pacific on October 29, 2026, which is 09:27 to 20:35 UTC. At most 5,000 users got it. Cursor says Anthropic did not build it.
- The runs as soon as the editor loads the extension, before any Claude conversation. It adds an attacker SSH key labelled svc-telemetry, sets up a startup task, tries to turn on SSH, opens a reverse tunnel and reports host details to 134.209.82.225.
- The report includes the names of environment variables that look like keys or tokens, not their values, per Phorion's analysis. A working tunnel would expose everything the user can read.
- Turning on SSH needs admin rights the extension does not have, so Cursor says the tunnel step likely failed on most Macs and Windows PCs. Machines where SSH was already on carry the real risk.
- We checked the public registries on October 30: Open VSX, the Microsoft marketplace and npm all go from 2.1.312 to 2.1.314, which Anthropic published between 00:12 and 01:20 UTC on October 30.
- Uninstalling is not enough. Run Cursor's remediation script for your platform, then rotate credentials from a clean machine.
What happened, in order #
Cursor is a code editor built on VS Code, and it installs extensions from its own marketplace. Cursor's notice says a modified version of Anthropic.claude-code, version 2.1.313, was available there from about 2:27am to 1:35pm Pacific time on October 29, 2026. Pacific time was UTC minus 7 that day, so the window is 09:27 to 20:35 UTC.
Cursor says it removed the version, shut the marketplace down, audited access, rotated its keys, rebuilt the marketplace and brought it back online. It says no other extensions were tampered with, at most 5,000 users were affected, and it will contact them directly. It also says the attacker's server no longer works, after it worked with the hosting provider to take it down.
How the build got into the marketplace is not public. Cursor's notice does not say, and The Hacker News reports that the method remains unclear.
Early reports said the bad build came through Open VSX, the open extension registry many VS Code-based editors use. The Hacker News and the OpenSourceMalware researchers both corrected that: the build was traced to Cursor's marketplace.
We checked the public registries ourselves #
On the morning of October 30 we asked each public registry for its version list of the Claude Code extension and package.
October 30, 2026, about 09:40 MDT
Open VSX GET https://open-vsx.org/api/Anthropic/claude-code/versions
2.1.314, 2.1.312, 2.1.311, 2.1.310, ... (no 2.1.313)
2.1.314 published 2026-10-30 01:07 UTC
Microsoft POST marketplace.visualstudio.com/_apis/public/gallery/extensionquery
anthropic.claude-code: 2.1.314, 2.1.312, 2.1.311, ... (no 2.1.313)
2.1.314 builds published 01:16 to 01:20 UTC on 2026-10-30
npm GET https://registry.npmjs.org/@anthropic-ai/claude-code
2.1.312 2026-10-27 18:36 UTC
2.1.314 2026-10-30 00:12 UTC (no 2.1.313 entry)
StepSecurity wrote that 2.1.313 was briefly listed on the Microsoft marketplace and now returns 404. We could not confirm or rule that out from today's data, because a removed version leaves no entry in the list. So treat a 2.1.313 install from any source as bad.
The skipped number matters for a quick check. If an extension list on a machine shows anthropic.claude-code at 2.1.313, that build did not come from any public registry we queried.
What the does, step by step #
This part comes from Phorion's analysis, with Cursor's notice confirming the outline.
- It runs first. A block of code sits at the top of extension.js, so it runs when the editor loads the file, before the extension's own start code. OpenSourceMalware counted 66 lines. No prompt or click is needed.
- It adds a door. It appends an attacker's Ed25519 public key, labelled svc-telemetry, to ~/.ssh/authorized_keys. Anyone with the matching private key can then log in as you, if your SSH service is reachable.
- It tries to open the door. It tries to turn on SSH with systemctl on Linux, systemsetup on macOS and PowerShell on Windows. Phorion says these steps carry no privilege escalation and often fail for a normal user.
- It calls home through a tunnel. It opens an outbound SSH connection to 134.209.82.225 as user tunnel and asks that server to forward a port back to your port 22. That is a reverse tunnel: the attacker reaches your SSH through a connection your own machine started, so a home router or an office firewall that blocks incoming traffic does not stop it. It retries every 60 seconds.
- It survives a restart. On macOS it writes a LaunchAgent named com.apple.sysmond.plist, a name chosen to look like Apple's. On Linux it adds an @reboot cron entry. On Windows it creates a SYSTEM scheduled task named SysMon, with a Startup-folder fallback.
- It reports in. It sends one JSON message over plain HTTP to port 8099 with the hostname, username, operating system, home folder, global Git email, public IP and up to 40 environment variable names that match KEY, TOKEN, SECRET, PASS, AWS or GCP. Phorion says the values are not sent.
Why uninstalling does not fix it #
The extension is only the delivery truck. The SSH key, the startup task and the hidden files in ~/.config live outside the extension folder, so removing the extension leaves them in place. Cursor's notice says the payload drops standalone persistence scripts that keep running.
That is why Cursor ships two scripts: remediate-macos.sh, run as the affected user and not as root, and remediate-windows.ps1, run from an elevated PowerShell. Both exit with an error if anything is left. Cursor's notice lists no Linux script; Phorion lists the Linux cron entry to remove by hand.
Who is really at risk #
The key and the startup task are installed either way. Whether an attacker could actually log in depends on one question: was SSH already accepting connections on that machine?
If SSH was off, the had to turn it on, and that needs admin rights it does not have. So Cursor says the tunnel step likely failed on most macOS and Windows hosts. Phorion also found a bug in the macOS path: run without root, the systemsetup check prints an error instead of the word Off, so the script never tries to enable Remote Login at all.
If SSH was already on, for example a Linux machine running sshd or a Mac with Remote Login enabled, the tunnel could connect and the planted key would let the attacker in as you while the attacker's server was up. Treat that machine as compromised and follow Cursor's advice to consider a rebuild.
In every case the report went out, so the attacker may hold the hostname, username, Git email, public IP and the names of secret environment variables. Names are not keys, but they tell an attacker what to look for.
How to check a machine #
Cursor's quick check for macOS, written here so it also prints when nothing is found. It works the same in a Linux shell:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "not found"
More places to look, from Cursor's and Phorion's indicators:
- Extension folder: anthropic.claude-code-2.1.313-<platform> under your editor's extensions directory.
- macOS: ~/Library/LaunchAgents/com.apple.sysmond.plist, ~/.config/.smt, ~/.config/.smtk and $TMPDIR/.stk_* files.
- Linux: an @reboot line in crontab -l that runs a hidden script.
- Windows: a scheduled task named SysMon, sysmon.cmd in the Startup folder and ~/.config/smt.cmd. Search both $HOME.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for svc-telemetry.
- Network: any connection to 134.209.82.225 on port 22 or 8099. Logins that came through the tunnel show up as coming from localhost.
- File hash: extension.js with SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15.
The lesson for teams that run AI coding tools #
An editor extension runs with your rights. It can read your SSH keys, your cloud credentials and every repository you can open. Auto-update means a bad build reaches you without anyone choosing it. Jenn Gile of OpenSourceMalware told The Hacker News that anyone with auto-update on could have received it.
VS Code-based editors let you turn extension auto-update off with the extensions.autoUpdate setting, pin a version with Install Another Version, and list every installed version with code --list-extensions --show-versions. Keeping that list per machine turns the next incident into a one-line search.
Who is affected #
| Case | Status |
|---|---|
| Cursor users who installed or updated Claude Code to 2.1.313 between 09:27 and 20:35 UTC on October 29 | Affected. Run Cursor's check and remediation script, then rotate credentials. |
| Any of those machines that already had SSH or Remote Login on | Highest risk. Treat as compromised and consider a rebuild, as Cursor advises. |
| VS Code users on the Microsoft marketplace | No 2.1.313 there in our October 30 query. StepSecurity reports a brief listing, so check the installed version to be sure. |
| Open VSX and npm users, including the Claude Code command line tool | No 2.1.313 in either registry, per our query and the corrected reports. |
| Cursor users who did not take that update on October 29 | Not affected, per Cursor's notice, which found no other tampered extensions. |
What to do #
- On every machine with a VS Code-based editor, list extensions with versions and look for anthropic.claude-code 2.1.313.
- On any hit, isolate the machine, run Cursor's remediate-macos.sh or remediate-windows.ps1, and remove the Linux cron entry by hand.
- Search authorized_keys for svc-telemetry on every machine, not only the ones you suspect, as Cursor recommends.
- Rotate credentials and sessions reachable by that user, working from a different, clean machine. Start with the variables whose names match KEY, TOKEN, SECRET, PASS, AWS or GCP.
- Block 134.209.82.225 and search past network logs for it.
- Update to 2.1.314 or later, and decide whether extensions on developer machines should update on their own.
What is still unknown #
- How the attacker got the build into Cursor's marketplace. Neither Cursor nor Anthropic has said.
- How many of the up to 5,000 users already had SSH on, so how many tunnels actually connected.
- Whether the brief Microsoft marketplace listing StepSecurity describes happened. Today's registry data cannot show a removed version.
- Anthropic has published no statement we could find as of October 30.
- The step-by-step analysis is Phorion's, StepSecurity's and OpenSourceMalware's. Cursor's notice confirms the behavior in summary but not every detail, such as the limit of 40 variable names.
Sources #
AI News Report· every headline, every morning.