Claude Code extension 2.1.313 backdoored on Cursor Marketplace: check for the svc-telemetry SSH key

A tampered copy of Anthropic's Claude Code extension, version 2.1.313, was available on the Cursor extension Marketplace for about eleven hours on 29 October 2026 and tried to install a persistent SSH backdoor on developers' machines. Cursor says at most 5,000 users were affected. Anthropic says the package was not built or published by it and that its own systems were not compromised. Uninstalling the extension is not enough to clean up: the payload drops its own persistence scripts, so anyone who installed or updated the extension in that window should run the check below.

Key points

• Cursor says a maliciously modified Anthropic.claude-code 2.1.313 was on its Marketplace between about 2:27am and 1:35pm PT on 29 October 2026 (0927 to 2035 UTC), and that at most 5,000 users were affected.
• The package tried to add an attacker's SSH key (comment svc-telemetry) to authorized_keys, open a reverse SSH tunnel to 134.209.82.225 and persist it, and sent host details to the same server.
• Cursor and the security firm Phorion both say the SSH step usually fails without administrator rights, but the key, the persistence and the data beacon still happen.
• Anthropic's Felix Rieseberg says the incident was not a compromise of Anthropic's systems or employee laptops, that the official channels are unaffected, and that only Cursor users were hit.
• Cursor says the attacker's server is offline, but also that the payload leaves standalone persistence behind, so uninstalling the extension may not be sufficient.

What to do

Who is affected. Anyone who installed or updated Anthropic.claude-code 2.1.313 from the Cursor Marketplace between 2:27am and 1:35pm PT (0927 to 2035 UTC) on Thursday 29 October 2026. Cursor names the macOS (darwin-arm64) and Windows (win32-x64) builds in its indicators. Phorion says the implant also contains setup logic for Linux. Cursor says it found no evidence that other versions of the extension or the official distribution are affected.

How to check. The malicious extension appends an attacker's public key, labelled svc-telemetry, to your SSH authorized keys. Cursor's check for macOS:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, Cursor's PowerShell check looks in $HOME\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for the same string. Phorion adds that the malware checks for the comment rather than the key itself, so when hunting across a fleet it is better to match the key's fingerprint: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk. If the key is found, treat the machine as impacted.

How to clean up. Cursor publishes remediation scripts (remediate-macos.sh, run as the affected user and not as root, and remediate-windows.ps1, run from an administrator PowerShell) that remove the extension, the persistence, the running tunnel processes and the attacker's key, and exit non-zero if anything remains. Download them only from Cursor's own notice, linked below. Cursor also advises you to isolate hosts that show evidence of the payload, to decide whether the machine should be rebuilt, and to rotate credentials and sessions reachable from the host, from a trusted system. Its reasoning: the data the malware collected is limited, but "the limited env-var collection does not rule out later credential access over the backdoor", which is the practical case for rotating keys and tokens.

Where to look for traces. Cursor lists these on macOS: ~/.config/.smt, ~/.config/.smtk, $TMPDIR/.stk_<10 hex> and ~/Library/LaunchAgents/com.apple.sysmond.plist. On Windows: %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, a scheduled task named SysMon and a fallback sysmon.cmd in the Startup folder. On the network, look for connections to 134.209.82.225 on TCP 22 (user tunnel) and HTTP POSTs to port 8099 on the same address.

What happened

According to Cursor's notice, published on 29 October, a maliciously modified version of Anthropic's Claude Code extension was available in the Cursor Marketplace from roughly 2:27am to 1:35pm Pacific time. The Register, which covered the story a day later, puts that window at 0927 to 2035 UTC, which matches. The package was spotted by Phorion, a macOS-focused endpoint detection vendor, which published its own analysis on 30 October.

Cursor says it removed the malicious version immediately on detection and blocked further distribution. It then shut down the whole VS Code Marketplace as a precaution, audited access and confirmed that no other extensions were tampered with, rotated its own keys, rebuilt the Marketplace and brought it back online. It also worked with the cloud provider hosting the attacker's server to take it offline. Phorion adds that Cursor pulled the 2.1.313 release from the npm and VS Code registries as well; Cursor's own notice describes the Marketplace removal.

Neither Cursor nor Anthropic has said how the package reached the Marketplace. The Register notes that prominent people in the security industry alleged the upload followed a breach at Anthropic. Rieseberg, a member of Anthropic's technical staff, answered on X that Anthropic is working with Cursor on the incident but that "a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish". Cursor has not described what access the attacker had, so that remains an account from one side.

Background

Code editor extensions run with the permissions of the editor and the user, so a backdoored extension gets access to local files, source code and developer tooling as soon as its code loads. Phorion makes this point about this incident: the injected code sits in front of the normal extension bundle and runs when Node loads the file, before the extension's usual activate function is called, so nobody has to click anything.

We have covered related cases on audiotale.net: 319 Chrome extensions that hijacked search for 13.4 million users, and hidden text in GitHub issues used against AI coding agents. What sets this one apart is that the tampered package was published under Anthropic's name, which Cursor describes as a version Anthropic did not develop.

How it works

Phorion's analysis splits the payload into four stages. Cursor's notice and Phorion's analysis agree on the main points; where one adds detail the other does not, we say which.

1. Prepare SSH access. The code makes sure ~/.ssh exists and appends the attacker's Ed25519 public key, comment svc-telemetry, to authorized_keys. It then tries to switch on the local SSH service: via systemctl on Linux, via sudo -n systemsetup -setremotelogin on on macOS, and by installing OpenSSH Server through PowerShell on Windows. None of this includes a privilege-escalation exploit, so it normally fails for a standard user.
2. Open a reverse tunnel. It writes a second, embedded private key (comment svc-telemetry-tun) to a hidden temporary file named .stk_ plus ten hex characters, then runs ssh or autossh to 134.209.82.225 as user tunnel with a remote forward of *:0:localhost:22. In Phorion's explanation, the attacker's server allocates a port, and the attacker can later log in through that port to the victim's own SSH service with the planted key.
3. Persist. On macOS a LaunchAgent labelled com.apple.sysmond runs a hidden shell script; on Windows a scheduled task named SysMon is attempted as SYSTEM with a Startup-folder script as the fallback; on Linux Phorion describes an @reboot cron entry. A background loop retries the tunnel roughly every 60 seconds, so the tunnel survives closing the editor.
4. Report back. A single HTTP POST goes to /beacon on port 8099 carrying the hostname, username, OS, architecture, home and working directories, the configured Git email, the public IP, status flags and up to 40 environment variable names matching words such as KEY, TOKEN, SECRET, PASS, AWS or GCP. Phorion stresses that these are names only, not values: an inventory of which hosts hold cloud credentials.

Why the backdoor mostly failed

Both vendors say the malicious code contained mistakes. Cursor says that, outside highly unusual cases where the editor was started with administrator privileges, switching on the SSH service fails because of errors in the code. Phorion found a specific macOS bug: the script runs systemsetup -getremotelogin without elevation, which as a standard user prints "You need administrator access to run this tool" and exits with status 0. The script only tries to enable Remote Login if the output contains "Off", so it skips the step. If Remote Login was already on, or is switched on later, the tunnel and key are in place and the access path works. Phorion also says the Windows path passes its PowerShell command through a helper that hard-codes /bin/sh, and that a crontab check on Linux can wipe existing user cron jobs when the script runs again.

None of that is a defence. The key was still dropped and the machine still reported itself to the attacker, which is why both Cursor and Phorion tell affected users to clean up and consider rotating credentials.

What it means

For developers. Check the key first, then the persistence files. Because the payload files are written outside the extension folder, removing the extension from the editor does nothing about the LaunchAgent or scheduled task. Teams should search endpoint telemetry for the indicators in Cursor's notice: the file paths, the IP, the key fingerprint and the command lines (ssh -N -R '*:0:localhost:22', schtasks /create /tn SysMon).

For security teams. Phorion's detection advice is that an editor's extension-host process (for example Cursor Helper) has no reason to modify ~/.ssh/authorized_keys, and that a non-Apple process writing a LaunchAgent with a com.apple.* label is a strong signal. Phorion sells endpoint detection, so read its claims about its own product's coverage with that in mind; the technical analysis is independently consistent with Cursor's notice.

For marketplace operators. The incident shows that a trusted publisher name is only as safe as the publishing path behind it. Cursor says it rotated keys and rebuilt the Marketplace, but has not said how the upload was authorised.

What we don't know yet

• How the tampered package was published. Neither Cursor nor Anthropic has explained the route. Anthropic says a malicious actor used access to Cursor's Marketplace; Cursor has not confirmed that wording.
• How many people were actually hit. Cursor says "at most 5,000" and that it will contact affected users directly. It has not said how many installed the package or how many machines show the key.
• Whether anyone was logged into. Cursor says that, without administrator rights, the attacker could not have logged in through the tunnel on most macOS and Windows hosts. Phorion says that if the SSH service was already running, the backdoor was ready. Neither has reported a confirmed intrusion.
• Who is behind it. Neither Cursor nor Phorion names an actor.

What to watch next

Cursor's notice is the document to follow, since it carries the indicators and the remediation scripts and may be updated. Watch for an account from Cursor of how the package was published, for any statement of how many users were affected, and for whether other editors' marketplaces report similar tampered releases. If you use Claude Code from the official channels, Anthropic says those versions are not affected.

Sources

• Cursor: Security notice, malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace (primary source, 29 October 2026)
• Phorion: Official Claude Code Extension Compromise, Security Advisory (30 October 2026)
• The Register: Anthropic: That Claude Code extension compromise... couldn't be us (30 October 2026)
• BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors (30 October 2026; we could not open this page, so no detail in this article relies on it)