> ## Content Index
> Fetch the complete content index at: https://www.skimwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Cursor says a tampered Claude Code extension tried to backdoor up to 5,000 developers' machines
- URL: https://www.skimwire.com/cursor-malicious-claude-code-extension-ssh-backdoor/
- Published: 2026-10-30T19:42:08.000Z
- Updated: 2026-10-30T19:42:08.000Z
- Description: Fake versions 2.1.312 and 2.1.313 sat in Cursor's marketplace for 11 hours Thursday. Uninstalling isn't enough. Here's how to check.
- Author: Jeremy Moon
- Tags: Security

## The skim

- For about 11 hours on Thursday, Cursor's extension marketplace served tampered copies of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313, for macOS and Windows. Anthropic didn't make them.
- The fake versions sent host details to an attacker, added an attacker's SSH key and set up persistence. Cursor estimates up to about 5,000 users may have installed them, according to The Verge and Sophos.
- Uninstalling isn't enough. Check your SSH authorized\_keys file for a key labeled `svc-telemetry`. If it's there, clean the machine and rotate your credentials from another computer.

## What happened

Cursor, the AI code editor, says the malicious extension was live in its VS Code extension marketplace from about 2:27 a.m. to 1:35 p.m. Pacific on Oct. 29\. That's about 9:27 a.m. to 8:35 p.m. UTC. In its [security notice](https://cursor.com/blog/claude-code-extension-security-notice?ref=skimwire.com), Cursor says the code collected the hostname, username, operating system, home directory, environment variable names, Git email and public IP address. It then tried to add an attacker-controlled SSH key, turn on the local SSH service and open a reverse SSH tunnel. To survive reboots, it installed a LaunchAgent on Macs and a scheduled task on Windows.

There's some good news. Turning on SSH needs admin rights, and Cursor says bugs in the malicious code mean that step failed on most machines unless Cursor was running as an administrator. On those machines, "the attacker could not have logged in through the tunnel," Cursor says. The attacker's server is also offline now, after Cursor worked with its hosting provider. Still, the key, the persistence scripts and the data sent to the attacker are real. Cursor says it pulled the extension, shut down the whole marketplace, rotated its keys and rebuilt the marketplace before bringing it back. On Friday morning it updated the notice with new indicators and clarified which versions were affected.

Cursor hasn't said how the tampered package got into its marketplace. It says it checked access and "confirmed no other extensions were tampered with."

## Why it matters

AI coding tools run with deep access to developers' machines, source code and cloud credentials. That makes them an ideal target for attackers. It's the latest in a run of attacks on the add-ons and agents people trust, after [319 Chrome extensions caught hijacking searches](https://www.skimwire.com/chrome-extensions-search-hijacking-13-million-socket/) and an [AGENTS.md trick aimed at coding agents](https://www.skimwire.com/agents-md-downloads-folder-attack-codex-claude-code/). A well-known name on a marketplace listing doesn't guarantee a safe build.

## What to do

If you installed or updated Claude Code from Cursor's marketplace on Oct. 29, run Cursor's check. On a Mac, search `~/.ssh/authorized_keys` for `svc-telemetry`. Cursor's notice has a PowerShell version for Windows and cleanup scripts for both systems. If the key is there, isolate the machine, run the cleanup or rebuild, and rotate any credentials and sessions it could reach. [Sophos](https://www.sophos.com/en-us/blog/malicious-claude-code-extension-distributed-through-cursor-marketplace?ref=skimwire.com) warns that "uninstalling the extension leaves the backdoor in place," so updating to a clean version alone won't fix an infected machine.

*Sources:* [*Cursor*](https://cursor.com/blog/claude-code-extension-security-notice?ref=skimwire.com)*,* [*Sophos X-Ops*](https://www.sophos.com/en-us/blog/malicious-claude-code-extension-distributed-through-cursor-marketplace?ref=skimwire.com) *and* [*The Verge*](https://www.theverge.com/ai-artificial-intelligence/1023096/cursor-says-around-5000-people-may-have-installed-a-malicious-claude-code-extension?ref=skimwire.com)*.*