A fake Claude Code update in Cursor's marketplace planted an SSH backdoor. Check for one key

In brief

On 29 October 2026 Cursor disclosed that maliciously modified builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313 for macOS and Windows, were available in its VS Code Extension Marketplace from about 02:27 to 13:35 Pacific time (09:27 to 20:35 UTC; 13:27 on 29 Oct to 00:35 on 30 Oct (Dubai time)). Cursor says Anthropic did not develop them. Microsoft Threat Intelligence, which analysed the code, says the packages were never on the Visual Studio Marketplace or npm, and that Anthropic told it Anthropic's systems were not compromised.

What the extension did

The injected loader runs as soon as the extension loads. It needs no prompt or chat. According to both Cursor and Microsoft, it:

• collects the hostname, username, operating system, working directories, Git email and the names of environment variables that look like secrets (Microsoft notes values were not sent);
• appends an attacker SSH key labelled svc-telemetry to authorized_keys, tries to enable the local SSH service and opens a reverse SSH tunnel;
• persists through a LaunchAgent called com.apple.sysmond on macOS, or a SysMon scheduled task with a Startup-folder fallback on Windows.

Cursor says enabling SSH needs admin rights the extension usually lacked, so on most hosts the attacker could not log in through the tunnel. The key, the persistence and the host report were still written. Cursor removed the builds, shut down and rebuilt the marketplace, rotated its keys and had the attacker server taken offline. It says no other extensions were tampered with.

How to check whether you are affected

You are in scope if you installed or auto-updated to either version from Cursor's marketplace on macOS or Windows during that window. Then:

1. Look for the key. On macOS, Cursor's check is grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted". On Windows, search %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for svc-telemetry. Cursor's command also prints "not impacted" when the file is missing or unreadable, and Microsoft adds that a missing key alone does not clear a host.
2. Hunt the indicators. Look for connections to 134.209.82.225, files named .smt, .smtk, smt.cmd, smtk or .stk_* under your config and temp folders, and the persistence names above.
3. Clean up properly. Microsoft says removing or updating the extension does not remove the persistence. Collect evidence first, then review and run Cursor's remediation scripts or remove each item by hand. The Windows script runs as Administrator with ExecutionPolicy Bypass, so review it before running it. Rebuild the machine if you cannot trust it.
4. Rotate from a clean machine. Rotate credentials and sessions that were reachable from affected hosts.

For the longer term, Microsoft points to Cursor's hardening options: limit extensions to approved publishers and add an installation cooldown for new versions. Treat an extension marketplace as a software supplier, not as part of the editor.

Sources and scope

Facts are from Cursor's security notice (29 October, updated 30 October 11:30 PT) and Microsoft's analysis of the loader (30 October), both checked on 2 November 2026. Anthropic's position is as reported by Microsoft; we did not find a statement from Anthropic itself. The framing and recommendations are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.