Claude Code Extension Backdoor in Cursor: What to Do

A Claude Code extension backdoor is not something you expect to find in your editor. But on 29 October 2026, a fake "Anthropic.claude-code" extension was served from the Cursor marketplace. If you use Cursor on a Mac or Windows PC, you need to know whether you installed it, and what to do if you did.

This post is based on Cursor's own notice and one news report. The story is still moving, so everything below is accurate as of 31 October 2026. Always read the live Cursor notice before you act. Cursor revised its indicators of compromise on 30 October and may do so again.

What happened

Cursor says that versions 2.1.312 and 2.1.313 of Anthropic.claude-code for Windows and macOS were malicious. Cursor also says they were "not developed by Anthropic".

According to the notice, the bad versions were available through the Cursor VS Code Extension Marketplace for about 11 hours. That was roughly 2:27am to 1:35pm Pacific time on 29 October 2026. Cursor published its notice the same day and updated it on 30 October.

Here is what we do not know:

• How it was published. BleepingComputer says Cursor has not explained how a package appeared under Anthropic's name. We will not guess.
• Whether Anthropic has commented. We found no Anthropic statement in either source.
• Who did it. Nothing we read says the attacker has been identified.
• How many people were hit. Cursor does not give a number. BleepingComputer says "up to 5,000 developers", which is a ceiling from a secondary source, not a confirmed count.

Cursor says it has "no evidence" that Claude Code itself or genuine Anthropic extension versions are affected. The problem is the fake listing, not the real tool.

What the Claude Code extension backdoor does

Cursor's notice describes a short list of actions.

It collects information. That includes hostname, username, operating system, architecture, home path, environment variable names, working directories, Git email and public IP address.

It tries to open a way back in. The malware tries to add an attacker's key to authorized_keys, enable local SSH, and open a reverse SSH tunnel. A reverse tunnel means your machine calls out to the attacker, so a home or office firewall does not block it. Cursor says that enabling SSH would generally fail without admin privileges.

It makes itself stick. On macOS it uses a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist. On Windows it uses a scheduled task named SysMon, with a Startup fallback. It retries about every 60 seconds.

The attacker key carries the comment svc-telemetry. That string is your main thing to search for.

Do not read "it mostly failed" as "I am safe"

BleepingComputer, citing a researcher at Phorion, reports that coding errors stopped many infections from getting remote access. For example, on macOS a command meant to check remote login ran without the privileges it needed.

That comes from secondary reporting, not from Cursor. It is worth knowing, but the same report says persistence and key installation still ran. A broken tunnel does not undo a planted key or a background task that keeps retrying. Treat any machine that ran these versions as exposed until you have checked it.

Who needs to check

You should check if all of these are true:

1. You use Cursor.
2. You are on macOS or Windows.
3. You installed or updated Anthropic.claude-code from the Cursor marketplace on 29 October 2026.

Cursor's notice does not name Linux as an affected platform. Linux appears only in the list of indicators, so we cannot tell you either way. If you run Linux, read the notice yourself.

Cursor's notice does not mention Open VSX, the VS Code Marketplace or npm. BleepingComputer says early reports of those were later ruled out and that Cursor was the only source. Even so, if you are unsure where an extension came from, check it.

How to check your machine

On macOS

Cursor's notice gives this command. We have copied it exactly:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

If it prints "svc-telemetry key found", treat the machine as compromised. The "machine not impacted" wording is Cursor's, and we would not rely on it alone. The command only finds one key comment. A changed or removed key would slip past it.

So also open Finder or Terminal and look in ~/Library/LaunchAgents/ for a file named com.apple.sysmond.plist. Cursor lists it as the persistence file. If it exists, assume you were hit, even if the key check came back clean.

On Windows

Cursor provides a PowerShell check. It looks for the SysMon scheduled task and the Startup fallback. We will not retype it here, because the notice is being updated. Use the version in the Cursor notice.

Remediation scripts

Cursor publishes remediate-macos.sh and remediate-windows.ps1. Per the notice, the scripts exit non-zero if anything remains, which gives you a clear signal. Download them from Cursor's page rather than from a copy. Scripts and hashes may change, so the live notice is the only safe source.

What to do if you find something

Cursor warns that "Uninstalling the extension may not be sufficient." Its advice, in plain terms:

1. Run Cursor's remediation script for your system and check that it finishes cleanly.
2. Consider rebuilding the machine. If you cannot be sure what ran, a clean install is safer than hoping.
3. Rotate credentials from a trusted system. Not from the affected one. Think SSH keys, API tokens, cloud keys, Git tokens and anything in your environment variables. The malware collected environment variable names, so your secrets setup is a good place to start.
4. Review your authorized_keys file and any other place a key could have been added.

If you manage a team, ask everyone the same questions and keep a short log of who checked what.

Cursor's response

Cursor says it removed the version, shut down the marketplace, rebuilt it, audited access and rotated keys. It also says it found no other tampered extensions. That is Cursor's own account, and we have not verified it independently.

Cursor also says the attacker's server, 134[.]209[.]82[.]225, is offline after the host took it down. That helps, but it does not remove anything already installed on your machine.

Habits that limit the damage next time

You cannot stop every supply chain slip. You can make one cheaper.

• Check the publisher and version before you install an editor extension, and watch for sudden new versions of tools you already use.
• Keep secrets off dev machines where you can. Use short-lived tokens and a secrets manager instead of long-lived keys in your shell profile.
• Use separate credentials per project. One stolen key then opens one door, not all of them.
• Review authorized_keys and login items now and then. It takes two minutes.
• Install fewer extensions. Each one runs with your permissions.

What to do next

1. Read the live Cursor notice today.
2. Run the check for your system and look for the persistence file or task.
3. If anything turns up, remediate, rotate credentials from a clean machine, and consider a rebuild.
4. Tighten your extension and secrets habits.

If you run a small team and want a second pair of eyes on your developer tooling and credential setup, get in touch with Paraline Tech.