If you use Cursor and its Claude Code extension, a recent incident is worth five minutes of your time. For about 11 hours on October 29, 2026, Cursor’s extension marketplace served tampered versions of Anthropic’s Claude Code extension. The builds looked and worked like the real thing — but they also tried to plant a persistent SSH backdoor on developer machines. Cursor estimates up to 5,000 users may have received the malicious build. The uncomfortable part is that simply updating or uninstalling the extension does not remove the backdoor. This guide explains what happened, what to check, and how to clean up safely. For broader context, see our overview of cybersecurity threats to watch in 2026.
What happened on October 29
Cursor says tampered versions 2.1.312 and 2.1.313 of the Claude Code extension were served from its marketplace between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, 2026. The malicious builds used the extension’s legitimate ID, anthropic.claude-code, which is part of why they were so convincing. Anthropic says its own systems were not compromised; the tampered copy was published through Cursor’s marketplace. The clean follow-up version is 2.1.314. Versions on Microsoft’s VS Code Marketplace and Open VSX were not affected. Cursor temporarily shut down its marketplace, removed the compromised package, rotated keys, and says it plans to contact affected users directly. For independent reporting, see Expel’s analysis of the fake Claude Code extension, Notebookcheck’s report on the tampered extension, and The Hacker News coverage of the trojanized extension.
What the tampered extension actually did
The attack worked in three parts. First, a short malicious loader ran as soon as the editor started, so nobody had to open a Claude chat for it to trigger. Second, it collected host details — including hostname, username, operating system, Git email address, public IP address, and the names of environment variables that look like passwords or tokens — and sent them to an attacker-controlled server. Third, it tried to add an attacker-controlled SSH key, labelled svc-telemetry, to the user’s authorized_keys file, and set up persistence: a launch agent disguised as an Apple component on macOS, a scheduled task called SysMon on Windows, and a cron entry on Linux. A reverse SSH tunnel was designed to retry roughly every 60 seconds. On most machines, the final login step failed because turning on remote login needs administrator rights the extension did not have — but the key, the startup item, and the leaked host details remain until removed, and a machine where remote login was already on, or where the user was an admin, was in a worse position.
Why uninstalling is not enough
This is the detail most people miss. The backdoor’s persistence lives outside the extension itself. Updating to the clean 2.1.314 build, or uninstalling Claude Code entirely, leaves the planted SSH key and the startup item in place. Security firm Expel, which investigated four incidents tied to the extension, found one case where malicious activity first appeared about eight hours after Cursor’s exposure window closed — consistent with a download during the window that only ran when Cursor next opened. So do not scope your check to the 11-hour window alone, and do not stop at the extension version number.
How to check your machine in 5 minutes
Start with the quick check Cursor recommends. On a Mac, open Terminal and search your ~/.ssh/authorized_keys file for svc-telemetry. On Windows, search the authorized_keys file in your user’s .ssh folder, and also C:\ProgramData\ssh\administrators_authorized_keys, using PowerShell. If that entry is present, treat the machine as affected. But a negative result is not a clean bill of health: Expel reports one incident where the tunnel was running yet no attacker key was found. Also look for the persistence items — on macOS, ~/Library/LaunchAgents/com.apple.sysmond.plist; on Windows, the SysMon scheduled task and startup entry; on Linux, a cron entry that runs at reboot. Check for suspicious outbound SSH connections and any unfamiliar files in your .config folder. If you are unsure, ask your IT or security team to review the machine rather than guessing.
How to clean up safely
If you find any sign of compromise, disconnect the machine from the network first. Cursor provides cleanup scripts for macOS and Windows that remove the extension, the attacker key, the startup items, and any running tunnels — use those, or follow Cursor’s security notice step by step. Then, from a different computer you trust, change every password, token, and API key that could have been reached from the affected machine, and review recent logins and sessions. Reinstalling the operating system is the safest option if you cannot be certain the cleanup is complete. Only after cleanup should you reinstall or update to the clean 2.1.314 build from a trusted source, and confirm the version number before resuming normal work. For a stronger login option, see our guide to passkeys in 2026.
How developers can reduce this risk
Extension marketplaces are part of the software supply chain, and this incident shows why they deserve the same caution as any download. Prefer extensions from verified publishers, and be suspicious of unexpected updates to tools you already trust. Where your editor allows it, consider delaying automatic updates for a few days so a bad release can be caught before it reaches you, and pin known-good versions for critical tools. Keep an inventory of which extensions your team installs — few organisations track this today, and that gap is exactly what makes scoping an incident hard. Finally, keep SSH hygiene tight: know which keys are in your authorized_keys file, keep remote login off unless you need it, and rotate credentials promptly after any suspected exposure. Related reading: AI phishing defenses that actually work.
The bottom line
The Cursor incident is a reminder that the most dangerous supply-chain attacks do not look dangerous. A trusted name, a familiar extension ID, and normal-looking behaviour hid a backdoor that survives uninstallation. The fix is not panic — it is a five-minute check, a proper cleanup if needed, and a little more discipline about what your editor is allowed to install. If you used Claude Code in Cursor around October 29, check today, not next week.
