Claude Code Extension Backdoor Survives Uninstall and Update
A Claude Code extension backdoor reached developer machines through Cursor’s marketplace, hidden in a tampered build of Anthropic’s coding tool. The malicious versions, 2.1.312 and 2.1.313, were available between 2:27 a.m. and 1:35 p.m. Pacific Time on 29 October 2026. Cursor says at most 5,000 users were affected.
What the Tampered Extension Did on a Developer’s Machine
The attackers did not publish a lookalike extension. They pushed a modified update under the genuine publisher identity and extension ID, anthropic.claude-code, so it arrived as a routine version bump.
A malicious JavaScript loader was added to the start of the extension’s main file, leaving the legitimate code below it untouched, according to analyses by the security firms Phorion and OpenSourceMalware. It ran when the extension loaded, with no user interaction and without anyone opening Claude Code.
The payload then did three things. It appended an attacker-controlled SSH public key, labelled svc-telemetry, to the user’s authorized_keys file. It tried to switch on the local SSH server and open a reverse SSH tunnel to 134.209.82.225, which would route back to port 22 on the developer’s own machine. And it installed a startup entry that retried the tunnel about every 60 seconds.
Cursor says the step that enables the SSH service probably failed on most machines, because it needs administrator rights the extension does not have. Phorion’s analysis found two implementation errors that helped: on macOS the malware asked for the Remote Login status without elevated privileges and got an error instead of an answer, and on Windows it tried to start the OpenSSH server through /bin/sh, which is not present on a standard install. The key, the startup entry and the data beacon all went ahead regardless.
Who Is Affected, and Why the Version Number Is Not the Test
The version number on its own cannot tell you whether you are compromised. Versions 2.1.312 and 2.1.313 are only malicious as they were served from Cursor’s marketplace for Windows and macOS during the exposure window.
Anthropic says the same extension on its own distribution channels is clean. “The versions on our official channels including VS Code and OpenVSX are not affected and this only impacts Cursor users,” Anthropic’s David Dworken said in a public statement quoted by The Hacker News. Microsoft said the malicious package was never published or distributed through the Visual Studio Marketplace or npm, and that Anthropic told Microsoft its own systems were not compromised.
So the test is not the number in your extensions list. It is whether the svc-telemetry key is sitting in your authorized_keys file. Cursor’s notice puts the exposure window at 2:27 a.m. to 1:35 p.m. Pacific Time on 29 October, which is 09:27 to 20:35 UTC, a span of roughly 11 hours.
One further discrepancy is worth knowing. Cursor’s advisory names Windows and macOS builds only, while Microsoft’s technical analysis documents a Linux persistence path in the same code, using a user crontab entry. Neither company has said a Linux build was distributed.
How to Check Whether Your Machine Has the Backdoor
Cursor publishes a single indicator that settles it, and it takes one command.
- On macOS or Linux: search ~/.ssh/authorized_keys for the string svc-telemetry.
- On Windows: run a PowerShell Select-String check for the same string against the authorized_keys files, including C:\ProgramData\ssh\administrators_authorized_keys where it exists, as Microsoft’s guidance advises.
- If the string appears: the machine is impacted and needs the cleanup below, not just an uninstall.
- If it does not appear: that is the strongest available signal, but it only means none of the published indicators matched.
Microsoft also lists the key’s fingerprint, SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, so an entry can be confirmed before anyone deletes a line from a live SSH configuration.
How to Remove It, Because Uninstalling Will Not
Uninstalling the extension does not remove the backdoor, and neither does updating it. The payload writes its files and startup entries outside the extension’s own directory, so both operations leave them in place.
Cursor states plainly that “uninstalling the extension may not be sufficient”, because the payload drops standalone persistence scripts that keep running. Microsoft is more specific: “Removing or updating the extension does not remove artifacts written outside its installation directory.” This is the single point most of the early coverage left in a footnote.
The published remediation runs in this order:
- Isolate the host: take it off the network before cleanup, and preserve the extension package and modified SSH files first if the incident will be investigated.
- Run Cursor’s cleanup script: remediate-macos.sh as the affected user rather than root, or remediate-windows.ps1 from an elevated PowerShell. Cursor says the scripts exit with a non-zero status if anything is left behind.
- Remove the key and the startup entry: delete only the confirmed svc-telemetry line, then the macOS LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist, the Windows scheduled task named SysMon with its Startup-folder fallback, or the crontab entry, checking what each one actually runs rather than trusting the name.
- Kill the processes and delete the leftovers: stop the SSH and retry processes, then remove the .stk_ tunnel identity files and the .smt and .smtk files.
- Rotate credentials from a clean machine: change anything the host could reach and revoke its sessions, using a trusted system to do it.
- Restart and re-check: confirm the artefacts do not return.
Cursor’s guidance directs users to version 2.1.314 of the extension, which does not contain the loader. Installing it is the right end state, but it is not a cleanup step.
What the Attacker Collected
The reconnaissance beacon went to 134.209.82.225 on port 8099 over unencrypted HTTP. Microsoft’s analysis lists what it sent.
| Data sent | Detail |
|---|---|
| Machine identity | Hostname, local username, operating system and CPU architecture |
| Paths | Home directory and current working directory |
| Network | Public IP address, retrieved via api.ipify.org |
| Developer identity | Global Git email address |
| Credential hints | The names, not the values, of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP |
No passwords or tokens were read directly by the script. Cursor warns that this limits what is known rather than what was possible, saying the narrow environment-variable collection “does not rule out later credential access over the backdoor”.
What Cursor and Anthropic Have Said
Cursor removed the malicious version, blocked further distribution and then shut its marketplace down entirely as a precaution. It audited access, said it found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back online. It also worked with the attacker’s hosting provider to take the server offline, and says it will contact affected users directly.
“This malicious version of the extension was not developed by Anthropic,” Cursor said in its public statement, which is also where the 5,000-user ceiling comes from; the written advisory itself gives no user count. Anthropic’s Felix Rieseberg said the company was working with Cursor on the incident and that there was no compromise of Anthropic’s systems or employee laptops.
As of 1 November 2026, the malicious versions have been removed, Cursor’s marketplace is back online, the attacker’s server has been taken offline, and no new malicious activity has been reported since 29 October. The incident follows a run of attacks aimed at developer tooling rather than end users, including a prompt-injection technique that targets AI coding agents’ instruction files and breaches that arrive through a trusted supplier, as in the ConnectWise Cloud Backup incident.
What Is Still Unconfirmed
How the attacker published under Anthropic’s publisher identity has not been explained by either company. That is the central unanswered question, because it determines whether the same route is still open.
Three other things remain open. Nobody has said how many machines actually accepted the key or established a tunnel, as against how many downloaded the build. No level of attacker access has been established. And no security vendor or government agency has attributed the attack to a named group.
Reports that the tampered build also appeared on Open VSX circulated on 29 and 30 October but have not been substantiated; Cursor’s own investigation, Microsoft’s statement and an analysis by Socket all point to Cursor’s marketplace as the only distribution point, and Ax Sharma of Manifold Security publicly disputed the Open VSX claim.
Frequently Asked Questions
Which Claude Code Extension Versions Were Malicious?
Versions 2.1.312 and 2.1.313, but only the Windows and macOS builds served from Cursor’s extension marketplace on 29 October 2026. The same version numbers from Anthropic’s own channels were not tampered with.
Does Uninstalling the Extension Remove the Claude Code Extension Backdoor?
No. Both Cursor and Microsoft state that files and startup entries written outside the extension’s directory survive an uninstall, and survive an update to a clean version as well. They have to be deleted separately.
Was Anthropic’s Own Distribution Compromised?
No. Anthropic says the builds on the Visual Studio Marketplace and Open VSX are unaffected and that its systems were not compromised. Microsoft confirmed the malicious package never went through its marketplace or npm.
Did the Attacker Actually Get Into Developer Machines?
That has not been established. Cursor says enabling the SSH service most likely failed without administrator rights, which would leave the tunnel unable to grant access, though the key, the persistence and the beacon still ran.
How Long Was the Malicious Build Available?
About 11 hours, from 09:27 to 20:35 UTC on 29 October 2026. Cursor updated its advisory the following day at 11:30 a.m. Pacific Time to widen the affected-version list and revise its indicators.
Is the Cursor Marketplace Safe to Use Now?
Cursor says it audited every extension, found no others tampered with, rotated its access keys and rebuilt the marketplace before putting it back online. Microsoft separately suggests restricting installations to approved publishers and setting a cooldown on new versions.
