How to check if the malicious Claude Code extension hit your Cursor

If you use Cursor on a Mac or Windows PC and installed or auto-updated the Claude Code extension on October 29, 2026, check your SSH authorized_keys file for a key labeled svc-telemetry. Cursor confirmed that versions 2.1.312 and 2.1.313 of Anthropic.claude-code on its extension marketplace were malicious between about 2:27 AM and 1:35 PM Pacific time that day. If the key is there, uninstalling the extension is not enough.

This guide gives the one-line check for macOS and Windows, the files and tasks the malware leaves behind, how to clean up, and which credentials to rotate. It is based on Cursor’s security notice, last updated October 30.

What happened

A tampered build of Anthropic’s Claude Code extension, not developed by Anthropic, was published to Cursor’s extension marketplace. Cursor removed it, shut the marketplace down, rotated its keys, rebuilt it and brought it back online. It says it audited access and found no other extensions were changed. BleepingComputer and The Hacker News also reported on the incident.

According to Cursor, the malicious extension:

• Sent host details to the attacker: hostname, username, OS, architecture, home folder path, environment variable names, working directories, Git email and public IP.
• Added the attacker’s SSH public key to your authorized_keys file.
• Tried to turn on the local SSH server and open a reverse SSH tunnel to 134.209.82.225.
• Installed persistence: a LaunchAgent on macOS, or a scheduled task named SysMon with a Startup-folder fallback on Windows, retrying the tunnel about every 60 seconds.

Two details limit the damage. Turning on the SSH server needs admin rights, which the extension lacks on most Macs and PCs unless Cursor was started as administrator, so on most machines that step failed. And Cursor worked with the hosting provider to take the attacker’s server offline. Cursor still says to follow its remediation steps regardless, because the key, persistence scripts and the data already sent remain.

Step 1: Check whether your machine is affected

Cursor’s check looks for the svc-telemetry key. Run it as your normal user.

On macOS

Open Terminal and run:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows

Open PowerShell and run:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

“No key found” means Cursor considers the machine not impacted. If you see “svc-telemetry key found”, continue below. You can also confirm which version you have under the Extensions view in Cursor; anything other than 2.1.312 or 2.1.313 was not flagged.

Step 2: Remove the backdoor

Cursor publishes remediation scripts on its security notice page that remove the extension, the persistence entries, running tunnel processes and the attacker’s key. Download them only from cursor.com, not from links shared in forums or chats.

• macOS: save remediate-macos.sh and run bash remediate-macos.sh in Terminal as the affected user, not with sudo.
• Windows: save remediate-windows.ps1, open PowerShell with Run as Administrator in that folder and run powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1.

Both scripts exit with a non-zero status if anything remains. If you would rather check by hand, these are the locations Cursor lists:

Platform	What to look for
macOS	svc-telemetry line in ~/.ssh/authorized_keys; ~/.config/.smt and ~/.config/.smtk; ~/Library/LaunchAgents/com.apple.sysmond.plist; $TMPDIR/.stk_ files
Windows	svc-telemetry in %USERPROFILE%\.ssh\authorized_keys; %USERPROFILE%\.config\smt.cmd and smtk; scheduled task SysMon; sysmon.cmd in the Startup folder; %TEMP%\.stk_ files
Linux	~/.ssh/authorized_keys, ~/.config/.smt, /tmp/.stk_ files, a cron @reboot entry running .smt
Network	Connections to 134.209.82.225 on port 22 or 8099

The LaunchAgent name com.apple.sysmond is chosen to look like a real Apple process. It is not one. Cursor’s notice describes Windows and macOS builds; the Linux paths are listed in its indicators of compromise.

Step 3: Rotate credentials

The extension only sent environment variable names, not values, but Cursor warns that the backdoor could have allowed later access to credentials. From a different, trusted computer:

1. Rotate API keys and tokens stored on the affected machine: cloud provider keys, GitHub or GitLab personal access tokens, npm tokens, and AI service keys.
2. Generate a new SSH key pair and remove the old public key from GitHub, GitLab and any servers.
3. Sign out of active sessions for your Git host, cloud console and password manager, then sign back in.
4. If the SSH server was running or Cursor ran as administrator, consider rebuilding the machine. Cursor says to assess whether a rebuild is needed.

Our guide to signing out of ChatGPT and Claude on every device covers the AI accounts. For a similar case of a compromised developer tool and the same kind of clean-up, see what we covered on the OVHcloud CLI compromise.

How to lower the risk next time

• Turn off automatic extension updates for tools with deep system access, and update them deliberately after a day or two. In Cursor or VS Code, open Settings and search for Extensions: Auto Update.
• Don’t run your editor as administrator. That alone stopped the SSH step on most machines here.
• Keep long-lived secrets out of environment variables and plain-text .env files on your laptop where you can.
• Read the warnings about AI coding tools and untrusted files in our piece on the AGENTS.md downloads-folder attack.

What we could not verify

• How many people installed the bad versions. DevOps.com reported up to 5,000 Cursor users; Cursor has not published a figure.
• How the attacker got the tampered build onto the marketplace. Cursor’s notice does not say.
• Whether any attacker actually logged in over the tunnel on a specific machine. Only an investigation of that machine can show this.

We checked Cursor’s security notice, including its October 30 update, on November 2, 2026. Outlet coverage is linked in the Sources section.

FAQ

Is the Claude Code extension in VS Code affected?

Cursor’s notice covers only its own Cursor VS Code Extension Marketplace and says it has no evidence that the official distribution is affected.

I use Claude Code in the terminal, not as an extension. Do I need to do anything?

The incident involved the Cursor marketplace extension package. Running the svc-telemetry check takes seconds and rules it out.

Is uninstalling the extension enough?

No. Cursor says the payload drops standalone persistence scripts that keep running after the extension is removed. Use the remediation script or remove each item listed above.

Is Cursor safe to use now?

Cursor says it removed the malicious versions, rebuilt the marketplace with rotated keys and found no other tampered extensions. Update to the current extension version and keep the check above in mind for any machine that was online on October 29.

Next step

Run the one-line check on every Mac and Windows machine where you use Cursor, including work laptops. If any shows the key, run Cursor’s remediation script and rotate your tokens from a different computer today.

Related guides

• Fake ChatGPT and Claude desktop apps on GitHub: check your PC
• OpenCode breach: how to replace your exposed AI API keys
• Claude Code Refusing Your Game? What Changed and What to Do

Sources

• Cursor: Security notice for Anthropic.claude-code 2.1.312 and 2.1.313 (October 29, updated October 30, 2026)
• BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors (October 2026)
• The Hacker News: Official Claude Code extension on Cursor Marketplace trojanized (October 2026)
• StepSecurity: Trojanized Claude Code extension delivered persistent SSH backdoor (October 2026)