The code editor Cursor distributed a tampered version of the Claude Code extension for a good eleven hours on October 29, 2026. Versions 2.1.312 and 2.1.313 for macOS and Windows did not come from Anthropic and tried to set up a permanent backdoor via SSH on the computer. Cursor's security notice gives the time as 2:27 a.m. to 1:35 p.m. local time on the US West Coast, which in Germany is 10:27 a.m. to 9:35 p.m. As The Decoder reports, citing Reuters, Cursor speaks of up to 5,000 affected users.
What did the tampered extension do?
The malicious code first sent information about the computer to a server belonging to the attackers: computer name, username, operating system, public IP address, the email address stored in Git, and the names of the environment variables, but not their contents. The program then added a foreign SSH key with the identifier svc-telemetry to the authorized_keys file. An autostart entry on the Mac, a so-called Launch Agent, or a scheduled task on Windows was then supposed to set up a tunnel to the attacker roughly every minute.
The attack did not fully succeed on most computers. The malicious code can only enable the SSH service with administrator privileges, and Cursor does not normally run with such privileges. Cursor has meanwhile had the attackers' server shut down together with the hosting provider. The key and autostart entry still ended up on the computer, though, and the collected information went to the attackers as long as their server was running. That is why Cursor recommends cleanup in every case.
How do you check whether your computer is affected?
You are only affected if three things coincide: you work with Cursor on macOS or Windows, you installed or updated Claude Code from Cursor's marketplace on October 29, and you received version 2.1.312 or 2.1.313 in the process. For other versions and for the official distribution by Anthropic, Cursor has found no indications of tampering. Anthropic itself publishes the extension in the Visual Studio Marketplace and in the Open VSX Registry.
Do you need to clean up your computer?
Claude Code from Cursor's marketplace, as of the security notice from October 30, 2026
What applies to your computer?
- Different version or installation from the Visual Studio MarketplaceNo indication of tampering
- Version 2.1.312 or 2.1.313 from Cursor, Mac or WindowsSearch for the key svc-telemetry
- Key svc-telemetry foundClean up and renew credentials
Uninstalling alone is not enough, the malicious code deposits its own startup scripts
Sources: Cursor Blog, Claude Code Docs
The version number in Cursor's extension view is of little help here. Cursor has removed the tampered versions, but an update or uninstallation only replaces the extension; the malicious code's scripts outside of Cursor keep running. A more reliable approach is to search for the foreign key. On the Mac, you enter grep svc-telemetry ~/.ssh/authorized_keys in the terminal. If a line appears, your computer is affected. On Windows, Cursor provides a PowerShell command that additionally searches the file administrators_authorized_keys in the folder C:\ProgramData\ssh.
What this means for you
If you worked with Cursor and Claude Code on October 29, it is best to run the search today. If the key shows up, download Cursor's cleanup script. On the Mac, you run the script as a normal user; on Windows, in a PowerShell with administrator privileges. The extension, autostart entry, tunnel, and key are removed; if anything remains, the run ends with an error code.
Afterwards, from a different device, you renew all credentials that were stored on the computer: tokens for GitHub, API keys for AI services, passwords in configuration files. The attackers only captured the names of the environment variables, but more would have been possible later via the backdoor. How to store API keys securely is shown in the lesson Sicherheit und Datenschutz mit API-Keys und Cloud-Speicher.
If you work in a team, tell everyone who uses Cursor, and replace shared access credentials together; tips on this can be found in our article on credentials in a team. Extensions in the editor run with your user privileges, and in the documentation for Claude Code, Anthropic makes clear that the vendor neither maintains nor vets the marketplaces for extensions.
Cursor published the security notice on October 29, 2026 and updated it on October 30, 2026.
Sources
