Claude Code Extension Malware: How to Check Cursor for the Fake SSH Backdoor and Clean Up

Listen to this article

9 min listenTech

15151×

0:00

-9:27

Last checked Nov 1, 2026. Picks are based on the prices, rates, fees and terms each provider publishes, checked at the source. We never rank products by commission. See how we’re funded.

Claude Code extension malware reached developers through Cursor’s extension marketplace on Oct. 29, 2026. You are affected only if you installed or updated Anthropic.claude-code version 2.1.312 or 2.1.313 from Cursor’s marketplace on a Mac or a Windows PC that day, and the fastest test is a one-line search of your SSH authorized_keys file for the label svc-telemetry. Cursor’s security notice says the tampered versions were live from about 2:27 a.m. to 1:35 p.m. Pacific time, which is roughly 5:27 a.m. to 4:35 p.m. Eastern. Anthropic did not write them.

The official channels were not hit. Microsoft’s analysis says the malicious packages were never published to the Visual Studio Marketplace or to the npm package @anthropic-ai/claude-code, and that Anthropic told Microsoft its own systems were not compromised. Below is who should worry about the Claude Code extension malware, what the code tried to do, the exact checks, and what to clean up. Everything here is as of Nov. 1, 2026, and Cursor updated its list of indicators on Oct. 30, so check its notice again before you act.

Who is affected by the Claude Code extension malware

Three conditions have to line up. You used Cursor, not Visual Studio Code, as the place you installed the extension. You were on macOS or Windows. And the extension installed or auto-updated to 2.1.312 or 2.1.313 during that roughly eleven-hour window on Oct. 29. If you installed Claude Code from Anthropic’s own channels, from the Visual Studio Marketplace, or through npm, Microsoft’s findings point away from this incident.

Cursor lists Windows and macOS builds in its indicators. Microsoft’s code analysis also describes a Linux path, using a cron job that runs at reboot, so a Linux user who somehow pulled the tampered package from Cursor should run the same checks. Cursor says it has no evidence that other versions of the extension or other extensions in its marketplace were tampered with.

What the Claude Code extension malware tried to do

According to Cursor, the injected code did four things when the extension loaded. It collected the hostname, username, operating system, home directory path, configured Git email and public IP address. It tried to add an attacker’s SSH key to your authorized_keys file, turn on the local SSH service and open a reverse tunnel to a server the attacker controlled. It tried to make that tunnel survive restarts. And it sent the collected details out.

Microsoft adds that the loader also looked for environment variables whose names contained words such as KEY, TOKEN, SECRET, PASS, AWS or GCP, kept up to forty of them, and reported the names. It reported names, not values, so the callback does not prove any secret was stolen. It does tell the attacker which kinds of secrets your machine holds. Background scripts retried the tunnel about every sixty seconds, and the extension kept working normally so nothing looked wrong.

The good news about the Claude Code extension malware is a real limit. Cursor says turning on the local SSH service needs administrator rights, which the extension does not have on most Mac and Windows machines, so on those hosts the step fails and the attacker could not have logged in through the tunnel. Cursor also says it worked with the hosting provider to take the attacker’s server offline. The bad news is that the key, the persistence scripts and the host report were still written or sent, which is why Cursor tells everyone who installed the versions to follow the cleanup steps anyway.

How to check your machine for the Claude Code extension malware

Start by confirming the version. Open the extensions panel in Cursor, find Claude Code and read the version number. If it was never 2.1.312 or 2.1.313, and you did not update from the marketplace during the window, the risk from the Claude Code extension malware is low, but the key check below takes seconds and is worth running anyway.

The malicious code labels the attacker’s public key svc-telemetry. On a Mac, open Terminal and run the command Cursor gives:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, open PowerShell and run Cursor’s version, which checks two files because administrators’ keys live in a separate location:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

If the message says the key was found, treat the machine as affected. If it says no key was found, Microsoft still cautions that a missing marker should not replace a look at the installation record, running processes and startup items, so glance at the table below too.

What to remove after the Claude Code extension malware, and why uninstalling is not enough

Removing or updating the extension does not delete what the Claude Code extension malware wrote outside its own folder. Cursor warns that uninstalling may not be enough because the payload drops standalone persistence scripts that keep running. These are the artifacts the two companies document.

The macOS file name looks like an Apple system service, and the Windows task name looks like a monitoring tool. Names alone prove nothing, so open the file or task and read what it runs before you delete anything. Cursor publishes cleanup scripts, remediate-macos.sh and remediate-windows.ps1, in the same notice. Run the Mac script as your normal user, not as root, and the Windows script from a PowerShell window opened as administrator. Read a script before running it, and if this is a work computer, tell your IT or security team first, because they may want the evidence preserved.

Microsoft’s advice on the key itself is to compare it with the published fingerprint before removing the exact line, and to leave unrelated SSH keys alone. Deleting every key in the file could lock you out of servers you legitimately use.

Which credentials to rotate after the Claude Code extension malware

Cursor’s instruction is to rotate credentials and sessions that were reachable from the affected machine, and to do it from a trusted device, not from the machine you are cleaning. Its reasoning is that the limited collection of variable names does not rule out later access through the backdoor. The practical order is to start with anything tied to the environment-variable names above: cloud keys, source-code hosting tokens, package-registry tokens and AI service keys. Then revoke active sessions where a service offers that option, and replace any SSH key pair you use from that machine. If the check found nothing and your version was never one of the two, you do not need to rotate anything because of this incident.

How to lower the risk after the Claude Code extension malware

Microsoft’s hardening advice for Cursor users is to restrict installs to approved publishers and to set an installation cooldown that delays newly published versions. A cooldown matters because this package was live for about eleven hours before Cursor pulled it. Cursor also shut the marketplace down, rotated its keys and rebuilt it before bringing it back. Until you set those controls, turning off automatic updates for extensions that run with access to your files and terminal is a reasonable stopgap.

This is not the only fake-AI-tool story this month. Our report on the Yoba malware hiding in fake ChatGPT and Claude desktop apps covers a similar trick, and our look at Tailscale SSH security issues explains why SSH access deserves a regular audit. More security coverage sits in the Tech section. This guide is general information, not security advice for your specific systems.

Editor’s Take

The lesson of this Claude Code extension malware incident is that a trusted brand name on an extension is not a safety check. The code ran with the same permissions as the person using the editor, and it was built to look like a monitoring tool so nobody would stop to ask about it. The failure that limited the damage was a technical one in the attacker’s own code, not a defense most users had in place.

Developers should treat the extension list the way they treat a package manager. Know who published each item, delay brand-new versions, and run the two-line key check above even if you think you were not exposed. Anyone who runs Cursor should treat the Claude Code extension malware as a prompt to audit what is installed. A clean result takes a few seconds, and it is the only way to be sure.