Tampered Claude Code Extension: How to Check Your Machine

If you use Cursor and you updated the Claude Code extension on 29 October 2026, stop what you are doing and run one check. For about 11 hours that day, Cursor’s extension marketplace served tampered copies of Anthropic’s Claude Code extension that tried to plant a persistent SSH backdoor on the machines that installed them. Updating the extension to the fixed version does not remove what the bad build left behind — the check below takes about 60 seconds, and it is the only way to know whether your machine was touched.

Quick answer: A tampered Claude Code extension tried to plant an SSH backdoor on up to 5,000 machines. Updating alone will not remove it — run this 60-second check first.

What happened on 29 October 2026

Tampered builds of the Claude Code extension — versions 2.1.312 and 2.1.313, published under the real extension identifier anthropic.claude-code — were served from Cursor’s VS Code Extension Marketplace between about 09:27 and 20:35 UTC on 29 October 2026 (2:27am to 1:35pm Pacific). Cursor says at most 5,000 users installed a malicious version, and that it will contact them directly. The tampered builds affected macOS and Windows machines only.

Fact	Status
Affected versions	Claude Code extension 2.1.312 and 2.1.313, from Cursor’s marketplace only
Exposure window	29 October 2026, about 09:27–20:35 UTC
Platforms	macOS and Windows
Users affected	At most 5,000, per Cursor
Fixed version	2.1.314 or later
Anthropic’s systems	Not compromised, per Anthropic
Other marketplaces	VS Code Marketplace, Open VSX and npm were NOT affected

What is confirmed, and what is not. Anthropic says its own systems were not compromised and that the tampered build was never distributed through its own channels. Cursor says it found no other tampered extensions in its marketplace, and that it shut the marketplace down temporarily, audited access, rotated keys and rebuilt the service before restoring it. How the attacker gained publishing access to Cursor’s marketplace has still not been disclosed. No CVE has been assigned to this incident.

What the tampered build actually does

The payload is a 66-line loader prepended to the clean extension code, so it runs the moment Cursor loads the extension — no Claude prompt, no click and no conversation is needed. According to Cursor’s security notice, Microsoft’s 30 October analysis and StepSecurity’s 1 November static analysis, it does four things:

Sends host details to the attacker. Host name, user name, operating system, architecture, home folder, Git email address, public IP address and the names — never the values — of up to 40 environment variables whose names match KEY, TOKEN, SECRET, PASS, AWS or GCP. The data went to 134.209.82.225 over plain HTTP.
Adds an attacker SSH key. An Ed25519 public key labelled svc-telemetry is appended to the user’s authorized_keys file.
Tries to open a remote door. It attempts to switch on the local SSH server — Remote Login on macOS, the OpenSSH Server feature on Windows — and open a reverse SSH tunnel back to the attacker’s server.
Installs persistence. A LaunchAgent named com.apple.sysmond on macOS, and on Windows a scheduled task named SysMon with a sysmon.cmd script in the Startup folder as a fallback. The persistence retries the tunnel about every 60 seconds.

Two facts limit the damage. Turning on the SSH server needs administrator rights, which Cursor normally does not have, so on most machines the tunnel could only connect where SSH was already running — security firm Phorion found the macOS check for Remote Login fails without admin rights, and the Windows OpenSSH install step likely fails too. And the attacker’s server has since been taken offline. But the key, the persistence files and the host details were still installed and sent. That is why the check matters even if nobody ever logged in to your machine.

Why updating the extension is not enough

This is the part most people get wrong. Updating to version 2.1.314 replaces the tampered extension, but it does not touch anything the payload placed outside the extension folder. The attacker’s key stays in authorized_keys, the LaunchAgent or scheduled task keeps retrying, and the dropped scripts remain on disk. Uninstalling the extension has the same gap: it removes the visitor and leaves the spare key on the hook. As Exabeam’s Steve Povolny put it, "Removing the extension only sends the visitor away while the spare key stays on the hook."

So the order of operations is: check first, then clean up with Cursor’s remediation script, then update. Never the other way round.

Check your Mac in 60 seconds

On each Mac that runs Cursor, open Terminal and run this one command:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

That is Cursor’s own check, word for word. It reads your SSH key file and changes nothing. If it prints "No key found; machine not impacted", you are done — that is Cursor’s wording for a clean result.

For a fuller check, also look for the persistence files and the tampered extension folder:

ls -la ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist
ls -d ~/.cursor/extensions/anthropic.claude-code-2.1.31[23]* 2>/dev/null

A svc-telemetry line, a com.apple.sysmond.plist file or any of the listed files means the machine received the payload. An extension folder for 2.1.313 means it downloaded the tampered build. One caution: a 2.1.312 folder installed before 29 October may be the clean release, so check whether its extension.js contains 134.209.82.225 before drawing a conclusion — the tampered bundle still reports version 2.1.312 internally, and the higher number existed only in the repackaged manifest.

Check your Windows PC

On each Windows PC that runs Cursor, open PowerShell and run:

$keys = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($keys) { Select-String -Path $keys -Pattern svc-telemetry }
Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue
Test-Path "$env:USERPROFILE\.config\smt.cmd", "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"
Get-ChildItem "$env:USERPROFILE\.cursor\extensions" -Filter "anthropic.claude-code-2.1.31*" -ErrorAction SilentlyContinue

Any match for svc-telemetry, a SysMon scheduled task, or the smt.cmd / sysmon.cmd files means the machine received the payload. Note that the SysMon scheduled task only gets created from an elevated session, so on most machines expect the Startup-folder sysmon.cmd fallback instead. The SysMon name is also used by the legitimate Sysinternals Sysmon tool, so confirm each hit against the file paths above before acting on it.

If the check finds something, do this next

Do not just delete the key and move on. Follow Cursor’s remediation steps in this order:

Isolate the machine if it shows evidence of the payload running, and keep the evidence before removing anything.
Run Cursor’s remediation script for your platform: remediate-macos.sh as the affected user on a Mac, or remediate-windows.ps1 from an elevated PowerShell on Windows. Both are linked from Cursor’s security notice. They remove the extension, the persistence, running tunnel processes and the attacker’s key, and they exit with a non-zero status if anything remains.
Rotate credentials from a different, trusted machine. SSH keys, Git tokens, CI/CD and package-registry tokens, cloud credentials and API keys — the payload sent environment variable names, and a working tunnel would have given the attacker a shell.
Rebuild the machine if the tunnel ever connected or if SSH was already running on it. A successful login through the tunnel appears in SSH server logs as coming from 127.0.0.1 or ::1 using the svc-telemetry key.
Update the extension to 2.1.314 or later, and block 134.209.82.225 at your firewall — the server is offline today, but the persistence keeps retrying it.

If you manage a team, run the same check across every machine that runs Cursor, not just the ones you remember updating on 29 October. Cursor’s auto-update can install an extension version without anyone noticing, and the 5,000 figure is an upper bound — Cursor says it will contact affected users directly, but the check takes a minute and removes the guesswork.

How to stop this happening again

The uncomfortable lesson here is that the tampered build came through a trusted channel, under the real extension identifier, with the real publisher name attached. Two habits reduce the risk next time:

Install coding extensions only from official channels, and verify the publisher. This incident was confined to Cursor’s marketplace — the same extension from the VS Code Marketplace, Open VSX or Anthropic’s own installers was clean. When an extension update arrives from an unfamiliar source, pause before accepting it.
Audit your SSH keys on a schedule. A monthly look at ~/.ssh/authorized_keys — and a rule that no editor, agent or installer may write to it — turns a silent backdoor into a visible one. The same discipline applies to the scheduled tasks and launch agents on your machine: anything you did not create yourself deserves a second look.

The broader point is one developers keep relearning: an AI coding assistant runs with the same access as the editor that hosts it. A compromised extension does not need your permission to act — it only needs your editor to load it. The check above is the cheapest insurance against that.

FAQ

Was my machine affected if I use VS Code instead of Cursor?

No. The tampered builds were served only from Cursor’s VS Code Extension Marketplace. Microsoft confirmed the packages were never published on the Visual Studio Marketplace or in the npm @anthropic-ai/claude-code package, and Open VSX was not affected either.

I updated to 2.1.314 already. Am I safe?

Not necessarily. Updating replaces the extension but does not remove the attacker’s SSH key, the persistence files or the dropped scripts. Run the svc-telemetry check above, and if it finds anything, run Cursor’s remediation script.

What exactly did the attacker learn about my machine?

Host name, user name, operating system, architecture, home folder, Git email address, public IP address and the names — not the values — of up to 40 environment variables whose names matched terms like KEY, TOKEN, SECRET, PASS, AWS or GCP. No secret values were sent, according to StepSecurity’s static analysis.

Did the attacker actually log in to affected machines?

Probably not on most of them. Enabling the SSH server needs administrator rights that Cursor normally lacks, and Phorion found bugs in both the macOS and Windows SSH setup steps. But the key and persistence were still installed, and the tunnel could connect where SSH was already running — so check your SSH logs for logins from 127.0.0.1 using the svc-telemetry key.

How do I know the fix worked?

After running Cursor’s remediation script, re-run the svc-telemetry check — it should print "No key found; machine not impacted" — and confirm the com.apple.sysmond.plist file (Mac) or SysMon task and sysmon.cmd (Windows) are gone. The script itself exits with a non-zero status if anything remains.

Sources and methodology

This guide is based on Cursor’s security notice (published 29 October 2026, updated 30 October), Microsoft Security Research’s analysis of 30 October 2026, StepSecurity’s static analysis of 1 November 2026, Phorion’s payload analysis, and The Hacker News’ reporting of Cursor’s notice. All factual claims were verified against the ThreatDefence advisory and the PlayCISO write-up on 9 November 2026; where sources disagree — for example, early reports naming Open VSX — this article follows Cursor’s corrected notice. The check commands are copied verbatim from Cursor’s notice and the ThreatDefence advisory. This article was desk-researched, not hands-on tested: the author did not install the tampered build or run the remediation script on an affected machine.

Sources:

ThreatDefence, "Claude Code 2.1.313 Extension Compromise: Detect and Remove" (published 30 October 2026, updated 2 November 2026): https://threatdefence.com/article/claude-code-openvsx-extension-backdoor-advisory
PlayCISO, "Claude Code Cursor SSH Backdoor: Microsoft IOCs, KQL, Fix" (updated 1 November 2026): https://playciso.com/blog/claude-code-cursor-backdoor
Medium, "Updated the Claude Code Extension in Cursor on Oct 29? How to Check Your Machine" (6 November 2026): https://medium.com/@getstackdrop/updated-the-claude-code-extension-in-cursor-on-oct-29-ab56537d92be