Skip to content

By submitting, you agree Forever may contact you about our products and services. Learn more in our .

Research
security

Claude Code Extension Compromised: What You Need to Know

A malicious build of Anthropic's Claude Code VS Code extension, version 2.1.313, was served through Cursor's extension marketplace on October 29 and plants an SSH backdoor. How to check if you are exposed, what to remove and rotate, and what is still unknown. Updated as the incident develops.

Gal Weizman, Omer Samet 3 min read

Last updated: October 30, 2026, 06:30 ET. This is a live page. We will update it as Cursor, Anthropic and the registries publish more.

TL;DR

  • Are you affected? If any machine installed or auto-updated anthropic.claude-code version 2.1.313, most likely through Cursor between 05:27 and 16:35 ET on October 29, treat that machine as compromised.
  • Potential impact: the build adds an attacker SSH key, installs persistence and reports host details. Where the reverse tunnel succeeded, the attacker could log in over SSH as you.
  • Do this now: check ~/.ssh/authorized_keys for svc-telemetry, remove the persistence listed below, update to 2.1.314, and rotate credentials reachable from that machine.

What happened

Claude Code for VS Code (anthropic.claude-code) is Anthropic’s official IDE extension. Cursor, VSCodium and other VS Code forks install it from marketplaces other than Microsoft’s.

On October 29, Cursor published a security notice saying a “maliciously modified version of Anthropic’s Claude Code extension” was available in the Cursor extension marketplace from about 5:27am to 4:35pm ET. Cursor says the build “was not developed by Anthropic” and that at most 5,000 users were affected. It repeated this on X on October 30 at 03:46 ET and asked all users to update to 2.1.314. OpenSourceMalware and StepSecurity published analyses of the payload; The Hacker News and Reuters reported it.

Cursor says it removed the version, shut down and rebuilt its marketplace, rotated its keys, and had the attacker’s server taken offline. Nobody has said how the build got into the marketplace or who is behind it. Anthropic has not published a statement that we could find.

What you need to know

  • Confirmed: one version, two builds. Cursor names anthropic.claude-code 2.1.313 for macOS ARM64 and Windows x64. It says it has “no evidence that other versions of the extension or the official distribution are affected.”
  • Confirmed: no prompt needed. OpenSourceMalware found a 66-line loader prepended to extension.js. It runs when the extension loads, before any Claude conversation.
  • Confirmed: what it does. It collects hostname, username, OS, home and working directories, Git email, public IP and the names (not values) of up to 40 secret-looking environment variables. It appends an attacker key to authorized_keys, tries to enable SSH, opens a reverse SSH tunnel and installs persistence that retries about every 60 seconds.
  • Confirmed: the login path usually failed. Cursor says enabling SSH needs admin rights the extension lacks on most macOS and Windows machines, so the attacker could not log in there. The key, persistence and beacon still landed.
  • Unconfirmed: whether Open VSX served it. StepSecurity says 2.1.313 was published to Open VSX. OpenSourceMalware has corrected its post to say the source was Cursor’s marketplace, and Socket found no Open VSX or npm record of 2.1.313. If you use VSCodium or another Open VSX client, check anyway.
  • Unknown: the entry point, how many of the 5,000 actually ran it, and whether any tunnel was used.

How to check if you’re exposed

# Installed version (VS Code, Cursor)
code --list-extensions --show-versions | grep -i claude
cursor --list-extensions --show-versions | grep -i claude
ls -d ~/.vscode/extensions/anthropic.claude-code-* ~/.cursor/extensions/anthropic.claude-code-* 2>/dev/null

# The planted key and the payload strings
grep -s svc-telemetry ~/.ssh/authorized_keys
grep -rls -e 134.209.82.225 -e svc-telemetry ~/.cursor/extensions ~/.vscode/extensions 2>/dev/null

# Persistence (macOS / Linux)
ls -la ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null
crontab -l 2>/dev/null | grep -F .smt

On Windows, check %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for svc-telemetry, and run schtasks /query /tn SysMon.

IndicatorValue (per Cursor, OpenSourceMalware, StepSecurity)
Versionanthropic.claude-code@2.1.313
C2134.209.82[.]225 (SSH 22 as tunnel, HTTP 8099 /beacon)
SSH keycomment svc-telemetry, SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
VSIX SHA-256 (darwin-arm64)432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62
VSIX SHA-256 (win32-x64)3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081
extension.js SHA-256ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15
Files~/.config/.smt, ~/.config/.smtk, $TMPDIR/.stk_*, ~/Library/LaunchAgents/com.apple.sysmond.plist, %USERPROFILE%\.config\smt.cmd, Startup\sysmon.cmd
PersistenceLaunchAgent com.apple.sysmond, scheduled task SysMon, cron @reboot
Processesssh -N -R '*:0:localhost:22', autossh -M 0

What you need to do

  1. Find your exposure. Sweep developer machines and extension telemetry for 2.1.313 and the indicators above. Cursor says it will contact affected users, but no email does not clear you.
  2. Isolate any hit. Disconnect it and keep evidence before cleaning.
  3. Remove the key and persistence, using Cursor’s remediate-macos.sh and remediate-windows.ps1 from the notice. Uninstalling the extension alone leaves the persistence running.
  4. Update to 2.1.314 or later and confirm 2.1.313 is gone from the extensions folder.
  5. Rotate credentials reachable from that machine (Git, cloud, CI, registry tokens, SSH keys), from a clean system. The beacon listed which secrets exist.
  6. Hunt for follow-on access. Review SSH and authentication logs from October 29 onward. If a tunnel connected, rebuild the host.

Trusting the publisher name would not have helped here. The build carried the official extension ID and the next version number, and auto-update installed it without a click.

Updates

  • October 30, 2026, 06:30 ET: first version.
securityincidentAIagenticextensionssupply chain

Continue reading