A manipulated copy of the Claude Code extension, published on Cursor’s extension marketplace under the name Anthropic, installed a persistent SSH backdoor on macOS and Windows machines that received versions 2.1.312 or 2.1.313 on October 29, 2026. Uninstalling the extension does not remove it. Verification is a single command, shown below.
Cursor states that the malicious versions were not developed by Anthropic. Engineers from Anthropic explained on Hacker News that the company’s systems were not compromised and that copies from the official VS Code Marketplace and Open VSX were not affected. Phorion, the security firm that published the first technical analysis, has already expanded its list of affected versions to match Cursor’s. As of publication, neither Cursor nor Anthropic had disclosed how the attacker gained access to publish or how many developers installed the malicious version.
It’s a textbook case of a supply chain attack: no one had to click on anything unusual. All it took was for the IDE to update a well-known extension.
Am I Affected by the Fake Claude Code Extension in Cursor?
You’re in scope if all three conditions are met:
- You use Cursor and had the Claude Code extension (
Anthropic.claude-code) installed from Cursor’s marketplace. - You work on macOS (Apple Silicon, darwin-arm64) or Windows (win32-x64). These are the two builds Cursor lists.
- The extension updated to 2.1.312 or 2.1.313 during the window Cursor indicates: approximately between 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, 2026.
If you installed Claude Code from the official VS Code Marketplace or from Open VSX, the open registry of extensions used by many VS Code-derived editors, Anthropic says you are not affected. If you never use the extension within Cursor, this incident does not apply to you.
Phorion indicates that the extension folders you should look for are anthropic.claude-code-2.1.312-darwin-arm64 and anthropic.claude-code-2.1.313-darwin-arm64, within your IDE’s extension directory. If a folder with either of those names exists, the malicious version was installed at some point.
How Do I Know if I Have the Backdoor on My Machine?
Search for the attacker’s SSH key. The payload adds a public key with the comment svc-telemetry to your authorized_keys file. Here is the one-line verification Cursor publishes:
macOS:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
Windows (PowerShell):
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }
“No key found” is the response you want to see. If the key appears, keep reading.
What Does This Backdoor Do?
The attacker inserted a function at the start of the extension’s minified extension.js. It runs as soon as the IDE loads the file, before the extension activates, so you don’t have to click on anything. According to Phorion’s analysis:
- Plants an access key. Adds the Ed25519 key
svc-telemetryto~/.ssh/authorized_keysand creates the directory and file if they don’t exist. - Attempts to activate SSH. On macOS it checks Remote Login; on Windows it tries to install OpenSSH Server. Without admin permissions, both attempts usually fail: Phorion found a bug in macOS’s verification and an incorrect shell path in the Windows step. Still, the key and persistence get written. Phorion warns that if you enable Remote Login later, the backdoor is ready to use.
- Opens a reverse SSH tunnel. Connects to
134.209.82.225on port 22 with an embedded private key (svc-telemetry-tun) and forwards a port back to your machine’s SSH daemon. A retry loop keeps the tunnel active even if you close the IDE. - Sends a reconnaissance beacon. A single POST to port 8099 with your hostname, user, operating system, home directory, global Git email, public IP, and the names (not values) of up to 40 environment variables containing
KEY,TOKEN,SECRET,PASS,AWS, orGCP. - Becomes persistent. On macOS it installs a user LaunchAgent with a name mimicking an Apple service. On Windows it creates a scheduled task, with a script in the Startup folder as a fallback.
Cursor reports that it worked with the hosting provider to take down the attacker’s server and it no longer functions. That closes the door for now, but it does not remove the key or persistence from your machine.
Why Doesn’t Uninstalling the Extension Remove the Backdoor?
Nothing from the payload lives within the extension folder. The key is in ~/.ssh, the persistence scripts in ~/.config, and the LaunchAgent or scheduled task in system locations. Removing the extension deletes extension.js, but the key, scripts, and tunnel loop stay where the payload left them.
What to look for (according to Cursor’s IOC list):
| Platform | Artifacts |
|---|---|
| macOS | Line svc-telemetry in ~/.ssh/authorized_keys · ~/.config/.smt · ~/.config/.smtk · $TMPDIR/.stk_<10 hex> · ~/Library/LaunchAgents/com.apple.sysmond.plist (label com.apple.sysmond) |
| Windows | Line svc-telemetry in %USERPROFILE%\.ssh\authorized_keys · %USERPROFILE%\.config\smt.cmd · %USERPROFILE%\.config\smtk · %TEMP%\.stk_<10 hex> · scheduled task SysMon · %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd |
Processes that reveal the tunnel: ssh -N -R '*:0:localhost:22' or autossh -M 0.
The payload also includes code for Linux (a @reboot entry in crontab, /tmp/.stk_*), but Cursor only lists macOS and Windows builds as affected.
How Do I Remove the Backdoor?
Use Cursor’s remediation scripts. Read them before running them: it’s good practice with anything stemming from a security incident.
- macOS:
https://cursor.com/static/security/claude-code-extension/remediate-macos.sh, run it as your normal user, not as root:bash remediate-macos.sh - Windows:
https://cursor.com/static/security/claude-code-extension/remediate-windows.ps1, run it in a PowerShell with elevated privileges:powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1
Cursor indicates that both scripts finish with a non-zero exit code if anything remains. Still, rerun the verification command at the end.
If you prefer to clean manually, the order Phorion suggests is:
- Stop the tunnel: the retry loop in shell and any
sshorautosshprocess connecting to134.209.82.225. - Remove persistence: the LaunchAgent (macOS) or the
SysMontask and Startup script (Windows), plus the.smtand.smtkfiles. - Delete the
svc-telemetryline fromauthorized_keys, remove the temporary.stk_*file, and confirm that SSH or Remote Login didn’t get enabled.
Cursor’s guide goes further: isolate any machine showing the payload executed and consider reinstalling it from scratch, because uninstalling the extension may not be enough.
What Credentials Should I Rotate?
The beacon sent the attacker the names of your environment variables, not their values. But if SSH was accessible on your machine, or you find any sign of an incoming login, assume everything that account could read is exposed. Rotate API keys, cloud credentials (AWS, GCP), Git tokens, and session tokens, starting with those matching the beacon’s filter. Do it from another trusted machine, as Cursor recommends.
According to Phorion, an incoming login through the tunnel would appear as coming from localhost (127.0.0.1 or ::1) using the svc-telemetry key. Check your SSH logs for those entries.
What Did “Made by Anthropic” Actually Guarantee?
Grego’s note
Based on what’s been disclosed so far, nothing failed in Anthropic’s build pipeline. The failure was in the marketplace, where the name “Anthropic” next to an extension was a label, not a signature. VS Code-style extensions don’t require cryptographic publisher signatures, and Cursor’s marketplace is a proxy built on Open VSX with its own publications added. There, the publisher name tells you who claims to have uploaded something, not who built it.
For a CTO the takeaway is concrete: a programming extension with AI runs with all the permissions of the developer’s user, including their SSH directory, their tokens, and their Git identity, and it updates itself. Treat extension sources like you already treat package registries. Pin versions and use allowed publisher lists where your IDE allows, and monitor auxiliary IDE processes writing to ~/.ssh: that’s exactly the behavior Phorion detects.
What about you? How do you verify who published an extension before installing it in your IDE?
- From the official VS Code Marketplace
- From Cursor’s marketplace
- From Open VSX
- I prefer another option (tell us which)
Comment below or, if this article reached you by email, reply directly to the email: your reply is published here.
Related: GlassWorm Is in Your Python Repos Now — What It Is, How It Works, What to Do