The backdoored Claude Code extension: what it means for your team

On 29 October, between about 2:27am and 1:35pm Pacific time, anyone who installed or updated the Claude Code extension from Cursor's extension marketplace on macOS or Windows may have received a tampered copy. Versions 2.1.312 and 2.1.313 of Anthropic.claude-code carried a payload that tried to open a back door into the developer's machine. Cursor caught it, pulled the versions, and published a security notice with cleanup scripts.

If your team uses Cursor, the first job is to check your machines, and we cover that below. The bigger lesson is about where AI coding tools now sit: inside the editor, next to your keys, updated automatically from a store most teams have never thought about.

What happened

Anthropic says its own systems were not involved. Felix Rieseberg from Anthropic told The Register that it “wasn't a compromise of Anthropic's systems or employee laptops”, and that the versions on Anthropic's official channels were not affected. Someone used access to Cursor's marketplace to publish a modified copy of the extension. How they got that access has not been explained publicly.

The malicious code sat at the top of the extension's JavaScript and ran as soon as the extension loaded. The endpoint security firm Phorion, which first spotted it, put it plainly in CSO Online: “The user doesn't need to interact with the extension for the payload to fire.” According to Cursor's notice, it:

sent the hostname, username, operating system and public IP to the attacker;
added an attacker-controlled SSH key, labelled svc-telemetry, to authorized_keys;
tried to turn on the local SSH service and open a reverse tunnel to the attacker's server;
installed a LaunchAgent on macOS, or a scheduled task on Windows, to retry the tunnel every minute.

Microsoft Threat Intelligence also found it scanning environment variable names for words like KEY, TOKEN, SECRET and AWS. It kept the names, not the values, which reads like an attacker taking inventory before coming back.

The tunnel usually failed, because turning on SSH needs administrator rights that most developers don't use day to day. Cursor is clear that this is not a reason to relax: even where the tunnel failed, the key was planted, the persistence was installed and the machine details were sent. Industry estimates quoted by The Register put the exposure at up to 5,000 developers.

Check your team today

Cursor's notice has the full list of indicators and a cleanup script for each platform. The short version:

Look for the key. On each Mac that runs Cursor:
```
grep svc-telemetry ~/.ssh/authorized_keys
```
On Windows, check the user's authorized_keys and the administrators' file under ProgramData\ssh. Phorion recommends matching the key's fingerprint from the notice, not only the comment, since a comment is easy to change.
Look for persistence. A LaunchAgent named com.apple.sysmond.plist on macOS, a scheduled task named SysMon on Windows, files such as ~/.config/.smt, and processes running ssh -N -R or autossh -M 0.
Don't stop at uninstalling. Updating or removing the extension does not remove what it planted outside its own folder. Run Cursor's script, or rebuild the machine.
Rotate what that machine could reach. Tokens, cloud credentials and sessions, rotated from a machine you trust. If an affected laptop held production access, treat it as an incident.

“Removing the extension only sends the visitor away while the spare key stays on the hook.” Steve Povolny, Exabeam, in CSO Online

Why this matters beyond one bad update

Most teams have a policy for npm packages and container images. Very few have one for editor extensions, and AI coding extensions are the most powerful ones they install. They read the whole repository, run commands, and sit in a process that can see the developer's shell environment, SSH keys and cloud logins. They also update on their own.

There is a second wrinkle that makes AI tools a target. Microsoft's terms keep its marketplace for its own products, so editors built on VS Code, such as Cursor, run their own store or rely on Open VSX. That means the same extension, from the same publisher, can reach your team through several stores, each with its own access controls. The publisher's name on the listing tells you who wrote the original, not who uploaded the copy you received.

Yash Kadakia of Security Brigade summed it up: “An extension marketplace is effectively another software supply chain.” We agree, and it is cheap to start acting like it.

A short policy for AI coding extensions

Keep an allowlist. Write down which AI extensions and CLIs the team uses, and from which source. VS Code's extensions.allowed setting can enforce it; check what your editor offers.
Prefer the vendor's own channel. Where a tool ships a CLI or installer from its own site or package registry, that is one fewer middleman. Anthropic's official channels were not affected here.
Slow down updates. Auto-updating an extension the hour it is published means you are part of the test group. A delay of a day or two for non-security updates would have kept most teams out of this window.
Keep long-lived secrets off developer laptops. Short-lived cloud credentials, SSO sessions and a secrets manager limit what any compromised process can take.
Don't develop as an administrator. It is the main reason the tunnel failed for most victims.
Watch for new SSH keys and outbound tunnels. Endpoint tools can alert on changes to authorized_keys and on ssh -R. Both are rare on a normal developer machine.

The takeaway

Nothing about the Claude Code extension itself was wrong. A copy of it, in one store, was swapped for a version that did something else. As coding agents get more access to our machines and repositories, the path they take to reach us deserves the same review as the code they write. Check your machines today, then put extensions on the list of things your team approves on purpose.

Sources: Cursor security notice (updated 30 October 2026), The Register, CSO Online.