A fake Claude Code extension tried to plant an SSH backdoor on up to 5,000 Cursor users. Run this one-line check
Cursor says a maliciously modified copy of Anthropic's Claude Code extension, version 2.1.313, sat in the Cursor VS Code extension marketplace from about 2:27 a.m. to 1:35 p.m. Pacific on October 29, 2026. Anthropic didn't build it. The package collected host details and tried to add an attacker's SSH key, open a reverse SSH tunnel and install persistence through a LaunchAgent on macOS or a scheduled task on Windows. Cursor says at most 5,000 users were affected and it will reach out to them directly. It pulled the package, shut the marketplace down, rotated keys, rebuilt it and worked with the host to take the attacker's server offline. On most Macs and PCs the SSH step failed without admin rights, but the key, persistence scripts and the data beacon could still land, so Cursor asks everyone who installed that version to check.
Why it matters
It's a big supply-chain scare for AI coding tools: one bad extension version in a marketplace you trust reached up to 5,000 developer machines in about 11 hours. Cursor warns that uninstalling alone may not remove the scripts it left behind.
Who it's for
Anyone who uses Cursor with the Claude Code extension, plus security and IT teams who manage developer laptops.
What it means for you
- On a Mac, run: grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found". Cursor's notice has the PowerShell version for Windows.
- If the key is found, isolate the machine and run Cursor's remediation script for your platform from the security notice.
- Rotate credentials and sessions that machine could reach, from a different, trusted computer.
- Check your Extensions list to make sure you're no longer on Claude Code 2.1.313, and that nothing else updated itself in the same window.
Applies to: Affects only Anthropic.claude-code 2.1.313 installed or updated from Cursor's VS Code extension marketplace between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. Cursor found no other extensions tampered with and no evidence other versions are affected. The marketplace is back online and the attacker's server is offline. The check and remediation scripts are free on Cursor's notice; questions go to security@cursor.com. Checked October 30, 2026.
Source: @cursor_ai on cursor.com ↗
Written by AgentStackList from the original post. Checked Oct 30, 2026. Features, plans and availability can change, so confirm on the source before you rely on it.
cursorclaude-codesecuritysupply-chainextensions
More Cursor tricks
- Cursor now lets you draw on your app to tell the agent what to fix: meet Annotate in design mode · Oct 27
- Cursor's Agent SDK is out: build a PR-fixing or Slack bot as a folder of code and deploy it with one command · Oct 26
- DeepSeek V4.1 Flash lands in Cursor: up to 47.7% on CursorBench for under $1 a task · Oct 26
- Cursor's agents can now click through your desktop apps to test what they build · Oct 23
Agent Stack Weekly · free
Get the week's best AI tricks
Limit and pricing changes, new MCP servers, and setup fixes for Claude Code, Codex, Cursor, Copilot and Antigravity.
No spam. Unsubscribe anytime. Read past issues