# A tampered Claude Code extension on Cursor's marketplace installed an SSH backdoor

Canonical: https://clawdocx.com/blog/claude-code-extension-cursor-marketplace
Author: Mira Castellan
Published: 2026-11-01
Updated: 2026-11-01

> Cursor says tampered Claude Code extension builds 2.1.312 and 2.1.313 reached its marketplace on 29 October. Here is how to check whether you are affected.

If you installed or updated the `Anthropic.claude-code` extension from Cursor's marketplace on 29 October 2026, check your SSH `authorized_keys` file for a key commented `svc-telemetry` before anything else. Cursor's security notice says two builds served that day, versions 2.1.312 and 2.1.313, were tampered copies that "were not developed by Anthropic", and that the payload tries to plant an attacker-controlled SSH key, enable the local SSH service and open a reverse tunnel. Uninstalling the extension does not finish the job: the notice warns that standalone persistence keeps running after the extension is gone.

## What does Cursor say happened?

Cursor's notice, dated 29 October 2026 and updated at 11:30am PT on 30 October to revise the indicators and clarify the affected versions, says a modified build of the extension "was made available in the Cursor VS Code Extension Marketplace" between roughly 2:27am PT and 1:35pm PT on 29 October. That is a window of about eleven hours. The notice says the attacker's server has since been taken offline with its hosting provider.

The notice does not explain how the package reached the marketplace, and that gap is the part worth watching. It is the one question a reader cannot answer from either company's published material today.

On the response, the detail comes from reporting rather than from the notice. The Register reported on 30 October 2026 that Cursor said it "removed the malicious version from the marketplace immediately upon detection and blocked further distribution", and "followed with a full shutdown of the VSCode Marketplace out of an abundance of caution", then checked other extensions, rotated its own keys and worked with a hosting provider to block the attacker's server.

Anthropic's position also reaches us through that reporting rather than through a page of its own. The Register reported that Felix Rieseberg, a member of Anthropic's technical staff, wrote on X: "We're working with Cursor on this incident, but it wasn't a compromise of Anthropic's systems or employee laptops", and that "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish."

## Am I affected, and how do I check?

Cursor's notice gives one test. The key comment `svc-telemetry` is the indicator, so on macOS and Linux:

```bash
grep -qs svc-telemetry ~/.ssh/authorized_keys
```

On Windows, search both of these for the same string:

```powershell
Select-String -Path "$HOME\.ssh\authorized_keys" -Pattern svc-telemetry
Select-String -Path "C:\ProgramData\ssh\administrators_authorized_keys" -Pattern svc-telemetry
```

If the key is present, the notice says the machine is impacted. The unauthorized key is an `ssh-ed25519` key with fingerprint `SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk`, and the reverse tunnel uses a second key, fingerprint `SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ`.

## What does the payload do?

The notice describes an `extension.js` in the extension folder, SHA-256 `ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15`, carrying the attacker IP and the string `svc-telemetry`. It collects host and user information and posts it to the attacker's server, then tries to add its SSH key, turn on the local SSH service and open a reverse SSH tunnel back out.

Two things are worth separating here. The notice says the SSH steps "would generally fail without admin rights", so a standard user account is a weaker target than an administrator one. But it also says the limited environment-variable collection it observed "does not rule out later credential access", which is why the remediation ends in rotating credentials rather than in deleting a key.

Network indicators from the notice: the attacker IP `134.209.82.225`, a reverse SSH login `tunnel@134.209.82.225` on TCP 22, and an HTTP POST beacon to port `8099/beacon`. The notice also points out that the lookups to `ifconfig.me` and `api.ipify.org` are legitimate services and are not indicators on their own, which is a useful piece of restraint in an IOC list.

## Which artifacts should you look for on each platform?

| Platform | Unauthorized key file | Persistence | Other artifacts |
|---|---|---|---|
| macOS | `~/.ssh/authorized_keys` | LaunchAgent `~/Library/LaunchAgents/com.apple.sysmond.plist`, label `com.apple.sysmond` | `~/.config/.smt`, `~/.config/.smtk`, `$TMPDIR/.stk_` plus 10 hex characters |
| Windows | `%USERPROFILE%\.ssh\authorized_keys` | Scheduled task `SysMon`, which attempts to run as SYSTEM; Startup fallback `sysmon.cmd` | `%USERPROFILE%\.config\smt.cmd`, `%USERPROFILE%\.config\smtk`, `%TEMP%\.stk_` plus 10 hex characters |
| Linux | `~/.ssh/authorized_keys` | cron entry `@reboot /bin/sh` pointing at `.config/.smt` | `~/.config/.smt`, `~/.config/.smtk`, `/tmp/.stk_` plus 10 hex characters |

One inconsistency inside the notice is worth knowing before you scope a sweep. Its introduction names Windows and macOS, and the tampered package hashes it lists cover only `darwin-arm64` and `win32-x64`, but its indicator list includes Linux paths and a Linux cron entry. We follow the notice's own indicator list and include the Linux row above, because a defender checking for artifacts loses nothing by looking and the notice supplies the paths. Treat the platform scope as the notice's weakest point rather than as settled.

Process indicators include `ssh -N -R '*:0:localhost:22'`, `autossh -M 0`, `schtasks /create /tn SysMon`, `systemsetup -setremotelogin on`, and `Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0`.

## What should you do if you find the key?

The notice's order matters, and the last step is the one people skip:

1. Run the check above.
2. Search endpoint, network and extension-installation telemetry for the indicators.
3. Isolate any host showing payload execution or backdoor installation.
4. Remove the unauthorized key, the persistence and any running tunnel process, and decide whether the host should be rebuilt.
5. From a trusted system, rotate the credentials and sessions that were reachable from affected hosts.

Cursor publishes a remediation script for each platform, `remediate-macos.sh` and `remediate-windows.ps1`, and says they exit non-zero if anything remains, so check the exit status rather than the console output. The notice says to run the macOS script as the affected user rather than as root, and the Windows one from an Administrator PowerShell. Questions go to `security@cursor.com`.

## Does the version number tell you anything?

Less than you would hope, and this is the trap. Anthropic's changelog lists 2.1.312 as a real Claude Code release dated 27 October 2026, so that version string belongs to legitimate builds as well as to the tampered one. It lists no entry for 2.1.313 at all. That absence is not evidence by itself: the changelog skips 2.1.313 and 2.1.315 both, so gaps in the sequence are ordinary there and cannot be read as a marker of a forged version.

What identifies the malicious artifacts is their hashes, not their version numbers. The notice lists tampered package hashes per version and platform, including `fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364` for 2.1.312 on `darwin-arm64` and `6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731` for 2.1.313 on `win32-x64`. Check the `svc-telemetry` key and the hashes; do not conclude anything from a version string on its own.

## What this says about extension marketplaces

The mechanism here is not a vulnerability in an agent. It is a distribution channel publishing something its publisher did not build, which is the same shape as the skill and plugin supply-chain problem we have covered before: the risk sits in what you install and where it came from, not in the agent reading the file. If you install third-party agent extensions, skills or plugins, our [security hardening guide](/docs/security-hardening) and the write-up of the [Clawjacked agent vulnerability](/blog/clawjacked-vulnerability-ai-agent-security) are the two most relevant pages here. The platform hubs for [Claude Code](/ai-agents/claude-code) and [Cursor](/ai-agents/cursor) track each product's own security pages.

We have not run the malicious build or reproduced any of this. Every indicator above is taken from Cursor's published notice, fetched on 1 November 2026, and the two statements from Cursor and Anthropic are attributed to The Register's reporting of 30 October 2026 rather than to a page either company published.

## Frequently asked questions

**How do I check whether the tampered extension affected me?**

Cursor's security notice says to search your SSH authorized_keys file for the string svc-telemetry. On macOS and Linux, run grep -qs svc-telemetry ~/.ssh/authorized_keys. On Windows, search both %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for the same string. If that key comment is present, Cursor says the machine is impacted.

**Was Claude Code itself compromised?**

Not according to Cursor's notice, which says the malicious 2.1.312 and 2.1.313 builds were distributed through the Cursor VS Code Extension Marketplace and were not developed by Anthropic. The notice describes a tampered redistribution of the extension rather than a flaw in Claude Code, and it does not implicate Anthropic's own installation channels.

**Is uninstalling the extension enough to clean the machine?**

No. Cursor's notice warns that uninstalling the extension may not be sufficient, because the payload writes standalone persistence that keeps running after the extension is gone. That persistence is a LaunchAgent on macOS, a scheduled task or Startup script on Windows, and a cron entry on Linux, and each has to be removed separately along with the unauthorized SSH key.

**Does having Claude Code 2.1.312 installed mean I am compromised?**

No, and the version number on its own is not the test. Anthropic's changelog lists 2.1.312 as a genuine Claude Code release dated 27 October 2026, so that version string is also carried by legitimate builds. What Cursor identifies as malicious is a specific set of extension packages with specific SHA-256 hashes that its marketplace served on 29 October, so check for the svc-telemetry key rather than the version.

**How many developers were affected?**

Neither company has published a figure. Cursor's security notice does not say how many users were affected, and The Register reported on 30 October 2026 an allegation from cybersecurity industry figures that up to 5,000 developers were infected, a number it says neither Anthropic nor Cursor has confirmed.

## Sources

- [Cursor security notice: malicious Anthropic.claude-code versions 2.1.312 and 2.1.313](https://cursor.com/blog/claude-code-extension-security-notice)
- [Claude Code changelog](https://code.claude.com/docs/en/changelog)
- [The Register: Anthropic says the Claude Code extension compromise was not theirs](https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682)