Claude Code 2.1.312 and 2.1.313 in Cursor's Marketplace Were Backdoored: Check Your SSH Keys Now

Correction, Oct 31, 2026: Cursor revised its notice. It now names two malicious versions from its own marketplace, 2.1.312 and 2.1.313, for Windows and macOS, and no longer gives a user count. Its page now carries the note “Oct 30, 2026, 11:30 am PT: We updated the IOCs and clarified affected versions.” Earlier, Cursor said 2.1.313 only and “at most 5,000 users”; Reuters reported the same figure on Oct 30. We’ve updated this story, added Cursor’s per-version file hashes and its Windows check. The official 2.1.312 on npm and Open VSX isn’t named as affected.

TL;DR: Cursor says malicious copies of Anthropic’s Claude Code extension, versions 2.1.312 and 2.1.313 for Windows and macOS, sat in Cursor’s own VS Code extension marketplace for about 11 hours on October 29, 2026 (Pacific time). Anthropic didn’t build them. Cursor first put the reach at up to 5,000 users but no longer gives a number. The extension tries to add an attacker’s SSH key, open a reverse SSH tunnel and survive reboots. If you use Claude Code inside Cursor, run Cursor’s one-line check for a key labelled svc-telemetry today.

What happened

In a security notice dated October 29, 2026, and updated October 30, Cursor said “a maliciously modified version of Anthropic’s Claude Code extension” was available in the Cursor VS Code extension marketplace between about 2:27 a.m. and 1:35 p.m. PT that day. In Manila time that is 5:27 p.m. on October 29 to 4:35 a.m. on October 30. The affected versions are “Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS” from the Cursor VS Code Extension Marketplace. Cursor says these versions “were not developed by Anthropic.” Its first notice said at most 5,000 users were affected; the revised notice drops that figure. Cursor says it has “no evidence that other versions of the extension or the official distribution are affected.” So the legitimate 2.1.312 on npm and Open VSX isn’t named.

According to Cursor, the extension:

• collects host details: hostname, username, OS, home folder, the names of environment variables, working folders, your Git email and your public IP;
• adds an attacker-controlled SSH key, labelled svc-telemetry, to your authorized_keys file, tries to turn on the SSH service and open a reverse SSH tunnel to 134[.]209[.]82[.]225;
• sets up persistence through a LaunchAgent on macOS, or a scheduled task with a Startup-folder fallback on Windows, and retries the tunnel about every 60 seconds;
• reports back with an HTTP POST to /beacon on port 8099.

Cursor says turning on SSH needs admin rights that the extension doesn’t have on most Macs and Windows PCs. On those machines that step fails, and the attacker couldn’t log in through the tunnel. The key, the persistence and the data report still happen, though. The attacker’s server is now offline. Cursor pulled the malicious version, shut its marketplace down, rotated its keys, rebuilt the marketplace and says no other extensions were tampered with. It hasn’t said how the build got in. Reuters reported that Anthropic didn’t immediately respond to a request for comment.

Why it matters

Our read: this one targets the machine you code on. That laptop holds SSH keys, cloud logins, .env files and Git access. The extension only grabbed the names of your environment variables, not their values. But a planted SSH key plus a tunnel is a door, and Cursor itself warns that the limited collection “does not rule out later credential access over the backdoor.”

It’s also a reminder that the extension marketplace is part of your supply chain, just like npm, and AI coding tools update often and automatically. We covered a similar developer-machine attack earlier this week, the GhostAction campaign that hid a stealer in a VS Code task.

At our check on October 31 (7:31 a.m. Manila), version 2.1.313 wasn’t listed on Open VSX or npm (or on the VS Code Marketplace at our October 30 check). Both show 2.1.314, published early on October 30 (UTC), as the latest. The 2.1.312 listed on npm and Open VSX is the official release; Cursor names only the copies in its own marketplace as malicious.

What to do now

1. Check whether you’re hit. If you installed or updated Claude Code 2.1.312 or 2.1.313 from Cursor’s marketplace on macOS or Windows on October 29, run Cursor’s check. On macOS:

   grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

   On Windows, in PowerShell (from Cursor’s notice; it also looks in C:\ProgramData\ssh\administrators_authorized_keys):

   $files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
   if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

2. If the key is there, take the machine off the network and run Cursor’s remediation script: remediate-macos.sh as your normal user (not root), or remediate-windows.ps1 from an Administrator PowerShell. Cursor says the scripts remove the extension, the persistence, the tunnel processes and the key, and exit with an error if anything is left. Cursor says uninstalling the extension may not be enough, because the persistence scripts keep running.

3. Rotate secrets from another computer. Change the cloud, Git, API and SSH credentials that machine could reach, and sign out its sessions. Do it from a clean device, as Cursor advises. If you’re unsure, rebuild the machine.

4. Teams: search your endpoint and network logs for the indicators in Cursor’s notice (the IP, port 8099, the SysMon task and the com.apple.sysmond LaunchAgent), and match extension files against Cursor’s modified VSIX SHA-256 hashes:

   Version	Platform	Modified VSIX SHA-256
   2.1.312	darwin-arm64	fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364
   2.1.312	win32-x64	3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081
   2.1.313	darwin-arm64	80402fdcad8799285fd93044976973ca000da7995fb93363f819bb8e4f84ee6c
   2.1.313	win32-x64	6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731

   Cursor also lists the SHA-256 of the modified extension.js: ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15.

Our tip: even if you’re clean, check ~/.ssh/authorized_keys on your dev machines now and then. Most laptops don’t need one at all. If you don’t run an SSH server on your laptop, keep remote login off. Cursor says that’s why the tunnel login failed on most machines, though the key, persistence and data report still went through. For more patch and incident guides, see our security hub.

Sources & method

Source	What it confirms	Link
Cursor security notice (Oct 29, 2026; updated Oct 30, 11:30 a.m. PT)	Versions 2.1.312 and 2.1.313 for Windows and macOS, the time window, not built by Anthropic, behaviour, the check commands, remediation scripts, VSIX hashes and indicators	Cursor
Visual Studio Marketplace: Anthropic.claude-code	Latest is 2.1.314; no 2.1.313 listed (checked Oct 30)	Marketplace
Open VSX: Anthropic/claude-code	Latest is 2.1.314, published Oct 30, 2026, 01:07 UTC; no 2.1.313 listed (checked Oct 31)	Open VSX
npm: @anthropic-ai/claude-code	2.1.314 published Oct 30, 2026, 00:12 UTC; no 2.1.313 (checked Oct 31)	npm
Reuters, via CNA (Oct 30, 2026)	Cursor’s earlier statement of up to 5,000 users; Anthropic didn’t immediately comment	CNA
The Hacker News (Oct 30, 2026)	Independent coverage of the incident (reports Cursor’s first notice)	The Hacker News

Last checked: Oct 31, 2026, 7:16 a.m. Manila (UTC+8) for Cursor’s notice; Oct 31, 2026, 7:31 a.m. Manila for npm and Open VSX; Oct 30, 2026, 7:00 p.m. Manila for the VS Code Marketplace. Method: We read Cursor’s notice and checked the extension’s version history on the VS Code Marketplace, Open VSX and npm ourselves. Times are converted from Pacific Daylight Time (UTC−7). Advice marked “Our advice”, tips marked “Our tip” and analysis marked “Our read” are ours. The thumbnail is an original OneSignalDesk card summarizing Cursor’s notice. No affiliate links. How we work.

Updates

• Oct 30, 2026, 9:00 p.m. Manila: First published. Cursor hasn’t said how the build got into its marketplace, and Anthropic hasn’t commented. We’ll add a dated note if either changes.
• Oct 31, 2026, 7:31 a.m. Manila: Corrected after Cursor revised its notice (Oct 30, 11:30 a.m. PT update). Added 2.1.312, the Windows and macOS scope, Cursor’s per-version VSIX hashes and its Windows check. Removed the 5,000-user figure as Cursor’s current notice; it’s now attributed to Cursor’s first notice and Reuters (Oct 30). New thumbnail.