Tampered Claude Code extension in Cursor: what to check

If you use the Cursor code editor with Anthropic’s Claude Code extension, check your computer today. For about 11 hours on 29 October, Cursor’s extension marketplace offered a tampered copy that quietly opened a back door.

Cursor confirmed the problem in a security notice. It says the Mac and Windows builds of versions 2.1.312 and 2.1.313 of the extension were affected.

Eleven hours, overnight in Australia

The bad versions were live from about 2:27am to 1:35pm Pacific time on 29 October. That’s 5:27pm on 29 October to 4:35am on 30 October in Perth, or 8:27pm to 7:35am in Sydney and Melbourne.

If Cursor updated the extension for you during that window, you may have it. Cursor said on X that at most 5,000 users were affected, BankInfoSecurity reports.

No click needed

You didn’t have to open the extension. Phorion, the security firm that analysed it, says the payload fired as soon as the editor loaded it.

Cursor says the code did three things:

Took notes. It sent the attacker’s server your computer’s name, your username, your Git email and your public IP address. It also sent the names of your environment variables.
Cut a key. It added the attacker’s SSH key, labelled svc-telemetry, meant to let them log in to your computer remotely.
Made itself at home. It set itself up to run again after a restart, disguised as a system service on a Mac and as a scheduled task on Windows.

It also tried to open a remote connection back to the attacker. Cursor says that step usually failed without admin rights, but the key and the restart trick were still installed.

The code sent the names of up to 40 settings that looked like passwords or keys, not their values. But an attacker who can log in could reach far more, which is why Cursor’s clean-up includes changing credentials.

Uninstalling isn’t enough

“Uninstalling the extension may not be sufficient,” Cursor warns. As The Register notes, installing the latest version doesn’t clear it either.

The company has published clean-up scripts for Mac and Windows, plus a list of file hashes and network addresses your IT provider can search for. The attacker’s server is now offline, according to Cursor.

If you rely on AI tools at work, our guide to what a stolen AI login can reach explains why changing those keys matters.

Cursor’s marketplace, not Claude Code itself

Cursor says it has no evidence that other versions of the extension, or Anthropic’s official downloads, were affected. OpenSourceMalware, which also analysed the code, says the copies on Microsoft’s VS Code Marketplace and on Open VSX are clean.

Cursor pulled the bad versions and took its whole marketplace offline “out of an abundance of caution”. It found no other tampered extensions, changed its keys and rebuilt the marketplace.

Anthropic’s Felix Rieseberg said on X it “wasn’t a compromise of Anthropic’s systems or employee laptops”, The Register reports. Anthropic says an attacker used access to Cursor’s marketplace to publish the tampered copy. Cursor hasn’t said how that happened.

Checklist

Check whether Cursor updated Claude Code overnight on 29–30 October. If it installed version 2.1.312 or 2.1.313 from Cursor’s marketplace on a Mac or Windows PC, run the key check on that computer.
Look for the attacker’s SSH key. On a Mac, search ~/.ssh/authorized_keys for svc-telemetry. On Windows, search %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. If the key is there, the computer is affected.
Disconnect an affected computer. Take it off the network before cleaning it, and ask your IT provider whether to rebuild it.
Run Cursor’s clean-up script. Download it from Cursor’s Claude Code extension security notice. On a Mac, run it as the affected user, not as root; on Windows, run it in PowerShell as administrator.
Change passwords and keys from a different computer. Rotate API keys, cloud logins and access tokens that were stored or used on the affected machine, and sign out its sessions.
Give your IT provider Cursor’s indicators. Ask them to search logs for connections to the address 134.209.82.225 and for the file hashes in Cursor’s notice.