A fake Claude Code update in Cursor tried to plant an SSH key on developer machines. Run the one-line check

For about eleven hours on Thursday, developers who installed or auto-updated the Claude Code extension inside the Cursor editor got a copy Anthropic never built. Versions 2.1.312 and 2.1.313 tried to plant an SSH key and a reverse tunnel on the machine.

Cursor pulled it and took the attacker’s server offline, but the extension writes files outside its own folder. Removing or updating it leaves those behind, and checking takes one command.

Uninstalling the extension does not remove what it planted. Check authorized_keys for svc-telemetry.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

A tampered Claude Code extension sat in Cursor’s marketplace for 11 hours

Cursor says the malicious Anthropic.claude-code 2.1.312 and 2.1.313 builds for Windows and macOS were served from its VS Code extension marketplace from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29. Cursor removed them, shut the marketplace down, rotated its keys, rebuilt it and brought it back.

Microsoft Threat Intelligence analyzed the injected loader on October 30. It collects the hostname, username, OS, Git email and the names (not values) of environment variables containing words like KEY, TOKEN or SECRET. It appends an Ed25519 key labeled svc-telemetry to authorized_keys, tries to turn on the local SSH service and opens a reverse tunnel to 134.209.82[.]225, retrying every 60 seconds. Microsoft says the Visual Studio Marketplace and the npm @anthropic-ai/claude-code package were not affected, and Anthropic told Microsoft its systems were not compromised.

Cursor users on macOS and Windows who updated on October 29

The exposure is narrow: Cursor on macOS or Windows, with the Claude Code extension installed or updated from Cursor’s marketplace during that window. Cursor says turning on SSH needs admin rights the extension usually lacks, so on most machines the tunnel step failed and the attacker could not log in.

The rest still ran. The key, the startup entries and the host report were written, and the startup entries keep retrying. Developer laptops hold cloud credentials, Git tokens and SSH keys, so a planted key on one of them is worth an hour of checking.

Grep for one key name, then clean up and rotate

• On macOS run grep -qs svc-telemetry ~/.ssh/authorized_keys && echo found. On Windows check %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for the same string.
• If it is there, isolate the machine and run Cursor’s remediation script for your platform (as the user on macOS, as administrator on Windows), then confirm nothing listed below remains.
• Rotate credentials and sessions reachable from that machine, from a different, clean device.
• Fleet-wide, search endpoint telemetry for the extension version and for connections to 134.209.82[.]225. Cursor’s hardening guidance covers limiting extensions to approved publishers and adding an install cooldown for new versions.

Details

• Package: Anthropic.claude-code 2.1.312 and 2.1.313, darwin-arm64 and win32-x64, Cursor VS Code Extension Marketplace only. No CVE assigned.
• Window: about 2:27 a.m. to 1:35 p.m. PT, October 29, 2026 (Cursor). Cursor updated its indicators on October 30.
• Persistence: macOS ~/Library/LaunchAgents/com.apple.sysmond.plist plus ~/.config/.smt and .smtk; Windows scheduled task SysMon, fallback sysmon.cmd in the Startup folder, %USERPROFILE%\.config\smt.cmd and smtk; temp identity files named .stk_ plus ten hex characters.
• Network and hashes: 134.209.82[.]225 (SSH on 22, beacon on 8099). Loader extension.js SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. Planted key fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk.

Hunt / verify

• Process command lines containing ssh -N -R '*:0:localhost:22' or autossh -M 0, and schtasks /create /tn SysMon on Windows.
• File events for .smt, .smtk, smt.cmd, sysmon.cmd or com.apple.sysmond.plist; Microsoft published Defender hunting queries for each.
• On macOS, systemsetup -setremotelogin on in shell history or logs; on Windows, a new OpenSSH Server capability you did not install.

Source: Cursor security notice; Microsoft analysis

Sources

• Cursor: Security notice, malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) in the Cursor VS Code Extension Marketplace
• Microsoft Security Blog: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].