Fake Claude Code extension on Cursor: how to check your machine

Cursor issued the alert on 29 October 2026, and Bleeping Computer published the details on 30 October. On 29 October, from 2:27 a.m. to 1:35 p.m. Pacific time (about 11 hours), a modified version of Anthropic’s Claude Code extension was available in the extension store of Cursor, the code editor built on VS Code. Up to 5,000 developers may have been exposed. These facts come from this single source, which relays Cursor’s warning and the analyses by researchers at Phorion and OpenSourceMalware.

What the malicious extension did

The affected version is 2.1.313. According to Cursor, it was not developed by Anthropic. Cursor has not explained how it came to be distributed under Anthropic’s name. The attackers added a JavaScript loader at the start of the extension.js file and left the rest of the legitimate code unchanged. The loader runs as soon as the extension loads, without you doing anything in Claude Code. It:

• collects the username, machine name, public IP address, Git email address and the names of environment variables linked to sensitive credentials;
• adds an SSH key controlled by the attacker, tries to enable SSH and open a reverse tunnel;
• sets itself up to persist on the machine: a LaunchAgent on macOS, a scheduled task or startup script on Windows. It retries the tunnel roughly once a minute;
• sends this information, along with the status of the backdoor, to a server at 134.209.82[.]225.

A backdoor that often failed, but still had effects

According to Phorion, programming errors probably prevented remote access on some machines. On macOS, the program checks whether remote login is enabled, but without administrator rights. The command then returns an error and the step that enables SSH is skipped. On Windows, it tries to install the OpenSSH server through /bin/sh, which is not present on a standard installation, and fails.

The SSH key and the persistence mechanism are still installed in both cases. The tunnel only gives access to the machine if an SSH server was already running on it. The reconnaissance data is sent even if the backdoor fails. The script does not steal credentials directly. The researchers believe this suggests the attackers planned to collect them manually once they had gained access through the tunnel.

How to tell if you are affected

You may be affected if you installed or updated the Claude Code extension in Cursor during those 11 hours on 29 October, and more so if version 2.1.313 shows up in your editor. The sign to look for is an SSH key named svc-telemetry on your machine.

Early reports also mentioned npm, Open VSX and Microsoft’s Visual Studio Code marketplace. It was later confirmed that the malicious extension was distributed only through Cursor. Cursor says it found no evidence that other versions of the extension, or its official distribution, were affected.

What to do if you are

If the key is present, follow Cursor’s remediation instructions. Removing the key is not enough: you also need to isolate the machine, rotate any secrets accessible from it, revoke active sessions and rebuild the environment from clean backups.

Cursor removed the extension and temporarily shut down its entire store. It used that time to review the other extensions and rotate all of its access keys before reopening it. Working with the hosting provider, it had the attacker’s server taken offline, which cuts off both the reverse tunnels and the transmission of collected data.

The attacker’s server is offline, but an SSH key planted on a machine does not disappear with it: the check has to happen on your own computer.