Claude Code Extension Backdoor (2.1.313): What Happened & How to Check

If Cursor auto-updated your Claude Code extension on October 29, check your SSH keys now. It takes 10 seconds.

Cursor confirmed that a "maliciously modified version of Anthropic's Claude Code extension" was live in its VS Code extension marketplace for about 11 hours. The build, 2.1.313, tried to add an attacker's SSH key, open a reverse SSH tunnel and survive reboots. Cursor says at most 5,000 users got it.

1. Claude Code extension backdoor at a glance

2. What happened

Researchers at Phorion and OpenSourceMalware spotted the bad build. A 66-line loader sat at the top of extension.js, in front of the normal extension code, so the extension still looked and worked like Claude Code. It ran when the editor started, with no click needed.

• It collected host details: hostname, username, OS, home folder, Git email, public IP and the names of environment variables.
• It added an attacker SSH key, labeled svc-telemetry, to authorized_keys.
• It tried to turn on the local SSH server and open a reverse tunnel to 134.209.82.225.
• It set up persistence: a LaunchAgent on macOS (com.apple.sysmond), a SysMon scheduled task or Startup script on Windows, cron @reboot on Linux.
• It reported back over HTTP to port 8099.

Cursor says that turning on SSH needs admin rights, so on most Macs and Windows PCs the tunnel step failed. But the key and persistence still got installed, so clean up anyway.

3. Official statements

• Cursor: the malicious version "was not developed by Anthropic." Cursor pulled it, shut down and rebuilt its marketplace, rotated keys, audited other extensions and had the attacker server taken offline.
• Microsoft: the bad packages "were never published nor distributed" from the Visual Studio Marketplace or npm. "Anthropic confirmed to Microsoft that their systems were not compromised."
• Anthropic: shipped 2.1.314. As of Oct 30, Ars Technica reported no public notice from Anthropic yet, and how the attacker got into the Cursor listing is still not public.

4. How to check if you're affected

You're at risk only if you installed or auto-updated Claude Code from the Cursor marketplace during the window. Run Cursor's check:

1. macOS / Linux: `grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "found" || echo "not found"`
2. Windows (PowerShell): search `$HOME\.ssh\authorized_keys` and `C:\ProgramData\ssh\administrators_authorized_keys` for svc-telemetry.
3. Also look for `~/.config/.smt`, `~/.config/.smtk`, a `.stk_` temp file, and the persistence items above.
4. Check extension version: anything other than 2.1.313/2.1.312 from Cursor's marketplace was not part of this incident.

5. How to fix it

1. Isolate the machine if the key is there.
2. Run Cursor's remediation script (remediate-macos.sh as your user, or remediate-windows.ps1 as admin) from the security notice. Uninstalling the extension is not enough; the persistence scripts keep running.
3. Update Claude Code to 2.1.314 or later.
4. Rotate every secret the machine could reach: cloud keys, GitHub tokens, API keys, SSH keys, sessions. Do it from a clean device.
5. Consider rebuilding the machine if the payload ran.

6. Don't put all your AI work in one tool

Yes, you can keep working while you clean up. In Sumus, Claude, GPT, Gemini and other top models work side by side as AI employees in one team chat, in the cloud. If one tool or extension goes down, switch the model, not your whole workflow, and keep your team's work in one thread.

What we're watching

• A public post-mortem from Anthropic or Cursor on how the listing was taken over.
• Any sign that credentials were used through the backdoor.
• Changes to extension signing on Open VSX and Cursor.

Sources

• Cursor, Security notice: malicious Anthropic.claude-code 2.1.313, Oct 29, 2026.
• Microsoft Security Blog, Inside a malicious Claude Code-branded extension, Oct 30, 2026.
• OpenSourceMalware and Phorion advisories, Oct 30, 2026.
• Ars Technica and The Hacker News, Oct 30, 2026.