A tampered Claude Code extension on Cursor's marketplace installed an SSH backdoor

If you installed or updated the Anthropic.claude-code extension from Cursor's marketplace on 29 October 2026, check your SSH authorized_keys file for a key commented svc-telemetry before anything else. Cursor's security notice says two builds served that day, versions 2.1.312 and 2.1.313, were tampered copies that "were not developed by Anthropic", and that the payload tries to plant an attacker-controlled SSH key, enable the local SSH service and open a reverse tunnel. Uninstalling the extension does not finish the job: the notice warns that standalone persistence keeps running after the extension is gone.

#What does Cursor say happened?

Cursor's notice, dated 29 October 2026 and updated at 11:30am PT on 30 October to revise the indicators and clarify the affected versions, says a modified build of the extension "was made available in the Cursor VS Code Extension Marketplace" between roughly 2:27am PT and 1:35pm PT on 29 October. That is a window of about eleven hours. The notice says the attacker's server has since been taken offline with its hosting provider.

The notice does not explain how the package reached the marketplace, and that gap is the part worth watching. It is the one question a reader cannot answer from either company's published material today.

On the response, the detail comes from reporting rather than from the notice. The Register reported on 30 October 2026 that Cursor said it "removed the malicious version from the marketplace immediately upon detection and blocked further distribution", and "followed with a full shutdown of the VSCode Marketplace out of an abundance of caution", then checked other extensions, rotated its own keys and worked with a hosting provider to block the attacker's server.

Anthropic's position also reaches us through that reporting rather than through a page of its own. The Register reported that Felix Rieseberg, a member of Anthropic's technical staff, wrote on X: "We're working with Cursor on this incident, but it wasn't a compromise of Anthropic's systems or employee laptops", and that "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish."

#Am I affected, and how do I check?

Cursor's notice gives one test. The key comment svc-telemetry is the indicator, so on macOS and Linux:

grep -qs svc-telemetry ~/.ssh/authorized_keys

On Windows, search both of these for the same string:

Select-String -Path "$HOME\.ssh\authorized_keys" -Pattern svc-telemetry
Select-String -Path "C:\ProgramData\ssh\administrators_authorized_keys" -Pattern svc-telemetry

If the key is present, the notice says the machine is impacted. The unauthorized key is an ssh-ed25519 key with fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, and the reverse tunnel uses a second key, fingerprint SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ.

#What does the payload do?

The notice describes an extension.js in the extension folder, SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, carrying the attacker IP and the string svc-telemetry. It collects host and user information and posts it to the attacker's server, then tries to add its SSH key, turn on the local SSH service and open a reverse SSH tunnel back out.

Two things are worth separating here. The notice says the SSH steps "would generally fail without admin rights", so a standard user account is a weaker target than an administrator one. But it also says the limited environment-variable collection it observed "does not rule out later credential access", which is why the remediation ends in rotating credentials rather than in deleting a key.

Network indicators from the notice: the attacker IP 134.209.82.225, a reverse SSH login tunnel@134.209.82.225 on TCP 22, and an HTTP POST beacon to port 8099/beacon. The notice also points out that the lookups to ifconfig.me and api.ipify.org are legitimate services and are not indicators on their own, which is a useful piece of restraint in an IOC list.

#Which artifacts should you look for on each platform?

One inconsistency inside the notice is worth knowing before you scope a sweep. Its introduction names Windows and macOS, and the tampered package hashes it lists cover only darwin-arm64 and win32-x64, but its indicator list includes Linux paths and a Linux cron entry. We follow the notice's own indicator list and include the Linux row above, because a defender checking for artifacts loses nothing by looking and the notice supplies the paths. Treat the platform scope as the notice's weakest point rather than as settled.

Process indicators include ssh -N -R '*:0:localhost:22', autossh -M 0, schtasks /create /tn SysMon, systemsetup -setremotelogin on, and Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0.

#What should you do if you find the key?

The notice's order matters, and the last step is the one people skip:

1. Run the check above.
2. Search endpoint, network and extension-installation telemetry for the indicators.
3. Isolate any host showing payload execution or backdoor installation.
4. Remove the unauthorized key, the persistence and any running tunnel process, and decide whether the host should be rebuilt.
5. From a trusted system, rotate the credentials and sessions that were reachable from affected hosts.

Cursor publishes a remediation script for each platform, remediate-macos.sh and remediate-windows.ps1, and says they exit non-zero if anything remains, so check the exit status rather than the console output. The notice says to run the macOS script as the affected user rather than as root, and the Windows one from an Administrator PowerShell. Questions go to security@cursor.com.

#Does the version number tell you anything?

Less than you would hope, and this is the trap. Anthropic's changelog lists 2.1.312 as a real Claude Code release dated 27 October 2026, so that version string belongs to legitimate builds as well as to the tampered one. It lists no entry for 2.1.313 at all. That absence is not evidence by itself: the changelog skips 2.1.313 and 2.1.315 both, so gaps in the sequence are ordinary there and cannot be read as a marker of a forged version.

What identifies the malicious artifacts is their hashes, not their version numbers. The notice lists tampered package hashes per version and platform, including fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364 for 2.1.312 on darwin-arm64 and 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731 for 2.1.313 on win32-x64. Check the svc-telemetry key and the hashes; do not conclude anything from a version string on its own.

#What this says about extension marketplaces

The mechanism here is not a vulnerability in an agent. It is a distribution channel publishing something its publisher did not build, which is the same shape as the skill and plugin supply-chain problem we have covered before: the risk sits in what you install and where it came from, not in the agent reading the file. If you install third-party agent extensions, skills or plugins, our security hardening guide and the write-up of the Clawjacked agent vulnerability are the two most relevant pages here. The platform hubs for Claude Code and Cursor track each product's own security pages.

We have not run the malicious build or reproduced any of this. Every indicator above is taken from Cursor's published notice, fetched on 1 November 2026, and the two statements from Cursor and Anthropic are attributed to The Register's reporting of 30 October 2026 rather than to a page either company published.