For: people who use the Cursor editor and installed or updated the Claude Code extension on October 29, 2026, and teams that manage developer machines. This article follows Cursor's own security notice and covers defensive checks only.
Developing: this article will be updated as the organisation publishes more
As of October 31, 2026Not yet known
- How the tampered versions were published under Anthropic's name
- Whether any systems of the marketplace operator or the publisher whose name was used were compromised
- How many users installed the tampered versions
- Whether any machine was accessed through the backdoor
Cursor updated its notice on October 30 at 11:30 am PT to revise indicators and clarify affected versions. It says anyone who may have installed the extension should follow its remediation steps even if an impact check comes back clean.
What Cursor users should do today
Find out whether you installed or updated the extension on October 29
The window Cursor gives is about 2:27 am to 1:35 pm Pacific Time on October 29, 2026, which is October 29, 6:27 pm to October 30, 5:35 am in Japan time (JST). Open the extension list in Cursor and check the installed version of the Claude Code extension. Cursor lists 2.1.312 and 2.1.313 for Windows and macOS as the tampered versions. If you did not install or update it in that window, Cursor's notice does not say you are affected.
Check authorized_keys for an entry labeled svc-telemetry
Cursor says the code tries to add an attacker-controlled SSH public key labeled svc-telemetry. Open your authorized_keys file (on macOS, usually in the .ssh folder of your home directory) and look for that label. Cursor's notice has separate commands for macOS and Windows; use them from the official page. Do not run commands copied from anywhere else.
Check for persistence: LaunchAgents, scheduled tasks, Startup items
Per Cursor, persistence is a LaunchAgent on macOS or a scheduled task with a Startup fallback on Windows, retried about every 60 seconds. Look at the LaunchAgents folders, the Task Scheduler and the Startup folder for entries you did not create. Cursor's notice lists the names and file paths to compare against.
If anything matches: isolate, remove, rotate
Cursor advises isolating hosts with evidence of payload execution or backdoor installation, removing the unauthorized key, the persistence entries and tunnel processes, and rebuilding the host where appropriate. Then, from a trusted machine, rotate credentials and revoke sessions that were reachable from the affected one: SSH keys, cloud and API tokens, Git and package-registry tokens, and browser or SaaS sessions. Cursor warns the limited environment-variable collection does not rule out later credential access.
For rotation order and least-privilege keys, see SSH keys with least privilege.
Run Cursor's remediation steps even if the check looks clean
Cursor provides a script for each platform and says to follow the remediation steps regardless of the impact check. Contact: the security address in Cursor's notice.
For teams: look at what extensions your developers can install
Decide which IDE extensions are allowed, pin or review updates for the ones that matter, and keep long-lived secrets off developer laptops where you can. For the same class of problem in packages, see npm supply-chain defense and the TanStack, Nx Console and GitHub chain.
What happened (from Cursor's notice)
All statements below come from Cursor's security notice and are attributed to Cursor, except where marked as press.
October 29, 2026, about 2:27 am PT
The first tampered version appears on the Cursor extension marketplace, according to Cursor.October 29, about 1:35 pm PT
The window ends (about 11 hours). Cursor removes the tampered versions and blocks further distribution.October 29
Cursor temporarily shuts down the marketplace, audits access and other extensions, rotates keys, rebuilds the marketplace and brings it back online. It works with the hosting provider to take the attacker's server offline.October 30, 11:30 am PT
Cursor updates its notice with revised indicators and clarified affected versions.
What is known and what is not
State as of October 31, 2026. This table will be rewritten as more is published.
| Item | What is stated | Status |
|---|---|---|
| Tampered versions on Cursor's marketplace | 2.1.312 and 2.1.313, Windows and macOS, about 2:27 am to 1:35 pm PT on October 29 | Confirmed (Cursor) |
| Who developed them | Cursor says Anthropic did not develop them | Confirmed (Cursor) |
| Behavior | Runs on load; collects host and user information; added the attacker's SSH key; tried to enable SSH and open a reverse tunnel; installed persistence via LaunchAgent or scheduled task; sent host details to the attacker | Confirmed (Cursor) |
| SSH enabling | Needs admin rights the extension usually lacks, so it fails on most hosts and the attacker could not have logged in through the tunnel there. The extension did add the attacker's key, install persistence and send host details | Stated (Cursor) |
| Other extensions and the official distribution | No evidence they are affected | Not affected per evidence so far (Cursor) |
| Other marketplaces (npm, Open VSX, VS Code Marketplace) | Early reports were corrected; Cursor's marketplace was the only source | Reported by press (BleepingComputer) |
| Number of users | Up to about 5,000 may have been exposed (press); no count in the Cursor notice we read | Not confirmed |
| How it was published under Anthropic's name | Not explained | Not explained |
| Access to any machine via the backdoor | Not stated | Not stated |
How to read this: the name that was used is not necessarily the party that was breached
Cursor states the tampered versions were not developed by Anthropic. Whether any system of the marketplace operator or the publisher whose name was used was compromised has not been explained in the sources we read, and this article does not claim either. "Exposed" means the version was available, not that a machine was accessed.
Adds an SSH public key (svc-telemetry)
↓→
Check authorized_keys
→ If found: remove, isolate the machine
Persistence (LaunchAgent / scheduled task / Startup)
↓→
Look for entries you did not create
→ Remove; consider rebuilding (Cursor)
Why a fake extension on a marketplace is dangerous
An editor extension runs with your user's permissions, usually with access to your files, Git credentials, SSH keys and the environment variables of your terminal. A tampered copy of a trusted name therefore starts with more access than most malware has. Adding a key to authorized_keys is meant to give the sender a way back in later, which is why removing the extension is not the same as cleaning the machine.
Generally, before installing or updating an extension: check the publisher and the exact name, be careful with sudden new versions of widely used extensions, and keep production credentials out of the environment in which you test new tools.
Sources
- Cursor, security notice on the Claude Code extension (published October 29, updated October 30, 2026) — cursor.com
- BleepingComputer, "Malicious Claude Code extension on Cursor planted SSH backdoors" (October 30, 2026) — bleepingcomputer.com
Update history
2026-10-31: First version, based on Cursor's notice (updated October 30, 11:30 am PT). This article will be updated when the publishing route or the user count is explained.
Read next
- Credentials and SSH: SSH keys with least privilege / multi-factor authentication
- Similar supply-chain incidents: TanStack, Nx Console and GitHub / npm supply-chain defense
- All 2026 incidents: security incidents of 2026