Developers who installed or updated Claude Code through Cursor on October 29 should examine their systems immediately. A maliciously modified release attempted to collect host data, establish persistence, and add an attacker-controlled SSH key. The Claude Code extension backdoor was confined, based on currently confirmed evidence, to Anthropic.claude-code version 2.1.313 distributed through the Cursor VS Code extension marketplace during a roughly 11-hour window.
Cursor said up to 5,000 users may have been affected. That figure represents the maximum potential exposure—not 5,000 confirmed infections or compromised computers. Cursor also explicitly stated that the malicious version was not developed by Anthropic. There is no evidence in Cursor’s notice that every Claude Code installation, Anthropic product, Cursor user, or VS Code marketplace was compromised.
Watch the video below to understand how the malicious Claude Code extension targeted developers, attempted to install an SSH backdoor, and created a potential path for attackers to access compromised systems.
What developers need to know
| Detail | Confirmed information |
|---|---|
| Affected extension | Anthropic.claude-code |
| Malicious version | 2.1.313 |
| Distribution channel | Cursor’s VS Code extension marketplace |
| Exposure window | Approximately 2:27 a.m. to 1:35 p.m. Pacific Time on October 29, 2026 |
| Maximum potential exposure | Up to 5,000 users; not a count of confirmed compromises |
| Subsequent clean release | Version 2.1.314, according to reporting; verify the current version through Cursor |
| Primary risk | System reconnaissance, an unauthorized SSH key, persistence, and attempted reverse SSH access |
The most authoritative and current response information is in Cursor’s official security notice. Cursor may update its indicators and remediation scripts as the investigation continues. Reuters separately reported the potential exposure and Cursor’s response.
Incident timeline
- October 29, approximately 2:27 a.m. PT: Malicious version 2.1.313 became available through the Cursor marketplace.
- During the exposure window: Users who installed the extension or received an automatic update could have executed the modified package in their development environment.
- October 29, approximately 1:35 p.m. PT: Cursor ended the package’s availability, placing the exposure window at about 11 hours.
- Following investigation: Cursor coordinated with the hosting provider to take the attacker-controlled server offline and published checks, indicators, and remediation guidance.
- October 30: Cursor said up to 5,000 users could have been affected. Reporting identified 2.1.314 as the clean subsequent release.
Taking the malicious server offline can interrupt command-and-control or tunneling activity. It does not remove an unauthorized key, delete persistence, terminate every running process, or establish that no data was exposed before the shutdown.
How the malicious VS Code extension worked
The compromised developer extension first attempted to gather information about its environment. Cursor reported collection of hostnames, usernames, operating-system details, processor architecture, home-directory paths, environment-variable names, current working directories, configured Git email addresses, and public IP addresses.
These details could help an attacker identify valuable developer workstations and understand where the extension was running. Environment-variable names can reveal which cloud platforms, package registries, or internal services are in use even when the investigation has not established that the corresponding secret values were collected.
The malware’s most serious behavior was its attempt to append an attacker-controlled public key labeled svc-telemetry to the user’s SSH authorized_keys file. It also tried to enable the local SSH service and create a reverse SSH tunnel to attacker-controlled infrastructure. A successful tunnel could provide a path back to a system that would otherwise be unreachable behind a firewall or network address translation.
Cursor reported persistence tailored to the operating system. On macOS, the package used a LaunchAgent identified as com.apple.sysmond. On Windows, it used scheduled-task or startup-script mechanisms, including a task named SysMon. Background processes were configured to attempt reconnection approximately every 60 seconds.
Why failed SSH enablement does not eliminate the risk
There is an important technical limitation. Cursor said enabling the SSH service required administrator privileges. Because the extension did not normally have those privileges, that step would fail on most macOS and Windows computers operating under standard configurations.
That does not make the incident harmless. The malicious package could still add the unauthorized SSH key where file permissions allowed it, install user-level persistence, and launch processes that repeatedly attempted to reconnect. Existing SSH services, unusual privilege configurations, or later privilege changes could also alter the outcome. Every exposed machine therefore requires verification rather than an assumption that the backdoor failed.
Confirmed facts and unresolved questions
What Cursor has confirmed
- Version 2.1.313 was maliciously modified and distributed through Cursor’s marketplace during the stated window.
- The package performed reconnaissance and attempted to install an SSH backdoor and persistence.
- The malicious release was not developed by Anthropic.
- Up to 5,000 users may have been exposed, but this is not a confirmed infection count.
- The attacker server was taken offline after coordination with its hosting provider.
What remains unresolved
- How many exposed installations executed every malicious stage successfully.
- How many machines established a reverse tunnel or transmitted system information.
- Whether attackers used the installed key to access any individual system.
- Whether credentials or proprietary data were accessed after execution.
Security researchers have also examined an artifact associated with Open VSX. Those analyses are useful for understanding code behavior, but they are separate from the confirmed Cursor marketplace attack. The presence or analysis of an Open VSX artifact does not, by itself, prove that Anthropic’s distribution infrastructure, Open VSX as a service, or every marketplace carrying Claude Code was compromised.
What potentially affected users should do now
- Establish exposure. Determine whether Anthropic.claude-code 2.1.313 was installed or updated between 2:27 a.m. and 1:35 p.m. PT on October 29. Check extension inventories, editor logs, software-management records, and endpoint telemetry.
- Run Cursor’s official impact check. Use only the current macOS or Windows instructions in Cursor’s notice. The check searches for the unauthorized SSH key labeled svc-telemetry.
- Inspect relevant telemetry. Search endpoint, network, DNS, process, file-change, scheduled-task, LaunchAgent, and extension-installation records for Cursor’s published indicators.
- Isolate suspicious systems. Disconnect machines showing malicious execution, persistence, unauthorized SSH configuration, or beaconing from sensitive networks while preserving evidence.
- Remediate from official guidance. Use Cursor’s official remediation scripts to remove the key, persistence mechanisms, and running tunnel processes. Do not run cleanup scripts copied from social media, unverified repositories, or unofficial articles.
- Rotate exposed access. From a separate trusted device, revoke and replace credentials, SSH material, API tokens, cloud sessions, repository tokens, browser sessions, and production access available to the affected computer.
Simply uninstalling version 2.1.313 or updating to a clean release may remove the extension but leave standalone LaunchAgents, scheduled tasks, startup scripts, processes, or changes to authorized_keys. Reporting identified version 2.1.314 as the subsequent clean release, but users should verify the latest available version through Cursor’s notice and current marketplace listing.
Official macOS and Windows impact checks
macOS: Open Terminal, visit the macOS impact-check section of Cursor’s official notice, and run the command exactly as Cursor currently publishes it. The check examines the user’s SSH authorization file for the svc-telemetry key. A match requires remediation and further investigation.
Windows: Open PowerShell and follow the Windows impact-check section in the same notice. Cursor’s check examines the applicable user SSH authorized_keys location for svc-telemetry. Use the official Windows remediation instructions if it is found.
Referring users to the live notice is important because Cursor can revise its scripts, paths, and indicators. Business systems, workstations with production access, and any machine showing evidence of compromise should be handled with professional incident-response assistance.
Indicators of compromise for security teams
Cursor published the following technical indicators. Organizations should correlate them with process ancestry, timing, extension version, and other evidence:
- Attacker IP address: 134.209.82.225
- Beacon or tunnel activity: Port 8099
- Unauthorized SSH key label: svc-telemetry
- SSH key fingerprint: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
- macOS persistence: LaunchAgent com.apple.sysmond
- Windows persistence: Scheduled task SysMon and associated startup mechanisms
- Connection pattern: Reconnection attempts approximately every 60 seconds
The extension reportedly used legitimate public-IP lookup services, including ifconfig.me and api.ipify.org. Ordinary access to these widely used services is not proof of compromise. Treat it as supporting telemetry only when it aligns with the affected version, exposure window, suspicious process activity, or stronger indicators.
Why developer extensions are valuable supply-chain targets
A malicious VS Code extension can operate where developers access source code, private repositories, SSH credentials, API keys, package registries, cloud configuration, signing systems, and production infrastructure. This makes a Cursor marketplace attack or similar software supply chain attack potentially more consequential than malware on a minimally privileged consumer device.
Organizations can reduce the risk by installing extensions only from verified publishers and trusted channels, reviewing publisher identity and version history, pinning or controlling updates in managed environments, and limiting editor privileges. Developers should use separate credentials for development and production, monitor unexpected SSH configuration changes, and avoid keeping unrestricted long-lived secrets on workstations. Extension updates should be treated as software supply-chain changes requiring appropriate trust, inventory, and verification.
Frequently asked questions
Was Claude Code itself compromised?
Cursor confirmed a maliciously modified extension version in its marketplace and said it was not developed by Anthropic. Current evidence does not justify claiming that every Claude Code installation, Anthropic product, or Anthropic’s own infrastructure was compromised.
Does potential exposure mean my computer was hacked?
No. Cursor’s figure of up to 5,000 users is a maximum potential exposure. Installation of version 2.1.313 warrants investigation, but successful key installation, persistence, tunneling, and attacker access must be established from evidence.
Is updating or uninstalling enough?
No. The SSH key and operating-system persistence can exist independently of the extension. Users must run Cursor’s official checks, remove identified artifacts, inspect telemetry, and rotate accessible credentials from a trusted system.
Who should seek professional incident-response help?
Organizations should obtain expert help for business systems, developer workstations with production or cloud access, machines containing valuable source code, and any endpoint showing the unauthorized key, persistence, tunnel processes, or communications with the attacker infrastructure.
