Claude Code Extension Backdoor in Cursor: Check Your Mac or PC

If you installed the Claude Code extension through Cursor on a Mac or Windows PC, check the version and your SSH keys. On 29 October 2026, Cursor’s marketplace served tampered versions 2.1.312 and 2.1.313 for about 11 hours. They attempted to plant a persistent SSH backdoor.

Cursor says the attackers’ server is offline and the reverse SSH step would normally fail unless Cursor had administrator privileges. The extension could still add an attacker-controlled key, install persistence files and send computer details out. Updating or uninstalling the extension does not remove those changes. Cursor has published checks and cleanup scripts for affected macOS and Windows machines.

Are you affected?

You may be affected if all of these are true:

• You use Cursor with the Anthropic.claude-code extension installed from Cursor’s built-in marketplace.
• Cursor installed or updated the extension to 2.1.312 or 2.1.313 between about 2:27am and 1:35pm Pacific Time on 29 October 2026. In India, that’s roughly 2:57 PM IST on 29 October to 2:05 AM IST on 30 October.
• The machine runs macOS or Windows, the platforms listed in Cursor’s security notice.

The extension was not tampered with on Microsoft’s Visual Studio Marketplace or on npm, according to Microsoft. People who use VS Code or the Claude Code command-line tool, and never installed the extension through Cursor, are not covered by this incident. Cursor says it audited its marketplace and found no other extensions were tampered with.

What the malicious extension did

Microsoft Threat Intelligence and Cursor describe the same chain of actions once the extension loaded:

1. Collected details about your computer: hostname, username, operating system, architecture, home folder path, working folders, your Git email and your public IP address. It also collected the names of environment variables (for example, names containing KEY, TOKEN, SECRET or AWS), but not their values.
2. Added the attacker’s SSH key, labelled svc-telemetry, to your authorized_keys file, so anyone holding the matching private key could log in.
3. Tried to switch on the SSH server on your machine and open a reverse SSH tunnel to the attacker’s server, which would let the attacker reach your computer even behind a router or office firewall.
4. Set up persistence: a LaunchAgent on macOS, a scheduled task named SysMon (with a Startup-folder fallback) on Windows, and an @reboot cron entry on Linux. Background scripts retried the tunnel roughly every 60 seconds.



Two things limited the damage. Turning on SSH needs administrator rights, which the extension did not have on most Macs and Windows PCs, and Cursor says errors in the malicious code made that step fail unless Cursor had been started with admin privileges. Cursor also worked with the hosting provider to take the attacker’s server offline, so the tunnel and the data upload no longer work. Neither undoes what was already written to disk or sent.



Step 1: Check for the attacker’s SSH key

Cursor’s quickest test looks for the svc-telemetry key in your SSH authorized keys. On a Mac, open Terminal and run:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, open PowerShell and run:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

If the key is found, treat the machine as compromised and continue with the steps below. If you check more than one user account on the same computer, run the test as each user.

Step 2: Run Cursor’s clean-up script

Cursor has published scripts that remove the tampered extension, the persistence files, any running tunnel processes and the attacker’s key. They exit with an error if anything is left behind.

• macOS: download remediate-macos.sh and run it as the affected user, not with sudo, from the folder you saved it to.
• Windows: download remediate-windows.ps1, close all editors, open PowerShell with Run as administrator, and run it from the folder you saved it to. The script cleans every user profile on the PC.

# macOS, as your normal user
bash remediate-macos.sh

# Windows, in an administrator PowerShell window
powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1

Step 3: Check the leftovers by hand

After the script finishes, run the key check from Step 1 again and confirm these files are gone:

Platform	What to look for
macOS	~/Library/LaunchAgents/com.apple.sysmond.plist, ~/.config/.smt, ~/.config/.smtk, and hidden .stk_ files in temp folders
Windows	Scheduled task named SysMon, %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, and sysmon.cmd in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
All	The svc-telemetry key in authorized_keys, and any connection to 134.209.82.225 (SSH on port 22 or HTTP on port 8099)

The name com.apple.sysmond is chosen to look like a real Apple service, and SysMon to look like Microsoft’s Sysmon tool. Don’t let familiar-looking names reassure you.

Step 4: Rotate keys and sessions from another device

Cursor’s advice is to rotate any credentials and sessions that the affected machine could reach, and to do it from a trusted system. The extension only took the names of environment variables, but Cursor notes that this does not rule out later access to credentials through the backdoor. On a work laptop that means:

• Cloud keys for AWS, Google Cloud or Azure, plus API keys for AI providers stored in .env files or shell profiles.
• GitHub or GitLab personal access tokens, SSH keys used for Git, and signed-in CLI sessions.
• Database passwords and tokens for any MCP servers you have connected to your editor. Our guide to setting up MCP servers in Claude, ChatGPT and Cursor shows where those configs live.

If you work at a company, tell your security team before you clean up. Microsoft recommends preserving the extension package, modified SSH files, generated keys and startup entries as evidence, and isolating machines that show signs of the backdoor. Cursor also says to consider whether a machine should be rebuilt instead of cleaned.

How to lower the risk next time

The incident shows how much access an editor extension can have once installed. Cursor has not explained how the malicious versions reached its marketplace. A few habits can reduce the risk from future extension incidents:

• Turn off extension auto-update in Cursor’s settings for machines that hold production keys, and update extensions deliberately.
• Keep the extension list short. Fewer extensions means fewer publishers you are trusting with your whole home folder.
• For teams: Cursor’s security hardening guide describes an allowlist of approved extension publishers and an install cooldown that delays new extension versions, with optional signature checks, managed through enterprise settings or device management.
• Keep secrets out of plain files where you can, and use short-lived tokens, so a stolen laptop session is worth less.

Why this matters for Indian developers

For developers in India, the affected window ran from the afternoon of 29 October into the early hours of 30 October. If you use Claude Code inside Cursor at work, check the extension version and run Cursor’s key check. Teams should coordinate the response with their security staff before changing or wiping a machine that may hold evidence.

My take

Cursor’s notice gives affected users a clear way to check and clean their machines. Its statement that the reverse SSH step usually failed is useful context, not a reason to ignore a planted key or persistence files. Run the check first, follow Cursor’s remediation instructions if it finds the key, and treat a machine that already had SSH enabled as a more serious case.

FAQ

Is it enough to update Claude Code to the latest version?

No. The malicious versions dropped separate persistence scripts that keep running after the extension is removed or updated. Run the key check and Cursor’s clean-up script.

I use VS Code, not Cursor. Am I affected?

Microsoft says the tampered extension was not on the Visual Studio Marketplace or npm. If you only installed Claude Code from there, this incident doesn’t apply to you.

Could the attacker read my code or files?

The backdoor needed the SSH server to be running for the attacker to log in, and that step failed on most Macs and Windows PCs because it needs admin rights. If your machine already had SSH turned on, or Cursor ran as administrator, assume the attacker could have logged in and rebuild the machine.

The check says no key found. Do I need to do anything else?

Cursor’s check reports “machine not impacted” when the key is absent. On company machines, Microsoft notes that a missing key alone shouldn’t replace a review of installation, process and network logs. It’s also worth confirming that Claude Code is on 2.1.314 or later and reviewing whether extension auto-update should stay on.

• SourceCursor Security Notice
• SourceMicrosoft Security Blog
• SourceCursor Security Hardening Docs