Check and remediate the backdoored Claude Code extension from the Cursor marketplace
Confirm whether you installed Anthropic.claude-code 2.1.312 or 2.1.313 from Cursor's marketplace on 29 Oct, grep for the svc-telemetry SSH key, run Cursor's remediate scripts if hit, then update to 2.1.314 and rotate credentials from a clean machine.
Tools used
- CursorMarketplace that briefly served the malicious VSIX; publishes check and remedia scripts
- Claude Code for VS CodeExtension identity anthropic.claude-code; update to 2.1.314+ after cleanup
- SSH authorized_keysWhere the svc-telemetry public key was appended
Step navigator
A clear yes/no on whether your machine got the svc-telemetry key, persistence removed via Cursor's remediate script when needed, Claude Code extension at 2.1.314+, and credentials rotated from a trusted host if you were hit.
Developers who use Claude Code inside Cursor on macOS or Windows and may have updated the extension on 29 Oct 2026.
Before you start
On 29 October 2026, Cursor published a security notice: malicious Anthropic.claude-code versions 2.1.312 and 2.1.313 briefly appeared on the Cursor VS Code Extension Marketplace (roughly 2:27am–1:35pm PT) and tried to plant a persistent SSH backdoor. Anthropic's David Dworken confirmed on HN that this hit Cursor's marketplace only — not the official VS Code marketplace, OpenVSX, or the Claude Code CLI/npm package. Phorion (Calum Hall) reverse-engineered the macOS path and stressed that uninstalling the extension alone is not enough. This guide sticks to those sources. Gaps they left (exact rebuild criteria for every fleet) stay gaps.
Step-by-step instructions
Confirm you were in the Cursor marketplace exposure window
Cursor's notice: you are in scope if you installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code Extension Marketplace on macOS or Windows between about 2:27am and 1:35pm PT on 29 October 2026. In Cursor, open Extensions → Claude Code and read the version. Anthropic (ddworken on HN): this did not impact the official VS Code marketplace, OpenVSX, or Claude Code on VS Code proper.
Why this step
Wrong marketplace or a version outside 2.1.312/2.1.313 is a different problem.
Check for the svc-telemetry SSH key Cursor documented
Cursor: the malware appends an attacker public key labeled svc-telemetry to your SSH authorized keys. On macOS run their one-liner; on Windows use their PowerShell snippet against $HOME\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. If the key is found, treat the machine as impacted. Phorion adds that hunters should also verify the public-key fingerprint (SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk), not only the comment string.
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
Why this step
The key is the durable login foothold even when SSH enablement failed.
If impacted, isolate and run Cursor's remediate script — do not stop at uninstall
Cursor: isolate hosts with evidence of payload or backdoor; uninstalling the extension may not be enough because standalone persistence keeps running. Download and run their platform script: macOS bash remediatete-macos.sh as the affected user (not root); Windows powershell -ExecutionPolicy Bypass -File .\remediatete-windows.ps1 from an elevated PowerShell. Scripts are at https://cursor.com/static/security/claude-code-extension/remediatete-macos.sh and …/remediatete-windows.ps1. Phorion's remediate checklist matches: kill tunnel processes, remove LaunchAgent/cron/SysMon artifacts, strip the planted key, then verify Remote Login was not left on unexpectedly.
Why this step
Persistence outlives the VSIX; the remediate script targets key, tunnel, and startup artifacts together.
Rotate credentials from a trusted system, then update to 2.1.314+
Cursor: rotate credentials and sessions reachable from affected hosts from a trusted system — limited env-var name collection does not rule out later access over the backdoor. Cursor and the Cursor@X account ask customers to update Claude Code for VS Code to 2.1.314. Re-check Extensions after update. Gap: Cursor does not publish a one-size rebuild decision tree; if SSH was already on or you see inbound localhost logins with the planted key (Phorion), treat rebuild as the safer call.
Why this step
Cleanup without rotation leaves sessions the beacon inventoried for the attacker.
End of guide · Reviewed Oct 31, 2026
Pro tips2
- Uninstalling the extension is not enough; Cursor and Phorion both say persistence scripts keep running.
- ddworken (Anthropic): official VS Code marketplace, OpenVSX, and Claude Code on VS Code proper were not impacted.
Common mistakes2
- Assuming a clean Claude Code CLI means the Cursor extension is clean — different distribution path.
- Ignoring the window: Cursor scoped exposure to installs/updates of 2.1.312/2.1.313 from its marketplace between ~2:27am and 1:35pm PT on 29 Oct.
FAQ2
Was OpenVSX or the Microsoft VS Code marketplace hit?
The attacker server is offline — am I fine?
Related field guides.
Teach Claude Code a security-response skill with live-write guards
Write a Claude Code skill that inventories your estate from GitHub, fans out exposure/mitigation/patch/rollout agents, labels every claim verified/read/assumed, proves fixes in capped containers, and blocks live writes behind a PreToolUse ask hook.
Measure Claude Code agent_summary spend on background-agent status labels
Upgrade past the cache-miss fix, turn on OpenTelemetry, group api_request events by query_source, then shrink or re-route Agent-tool subagents so status-label calls stop eating your quota.
Automate unstructured repo work with GitHub Agentic Workflows
Install gh aw, initialise the repo, have a coding agent write a Markdown workflow, compile it to lock.yml, commit both, and put a drift check in CI so you never ship Markdown without its compiled Actions file.
Reduce attack surface with Claude before you chase individual CVEs
Have Claude inventory what code is reachable by default, before authentication, and under conflicting config options, then gate or feature-flag what you do not need, and prove the change with the project tests.
Grow a shared CLAUDE.md from every PR mistake
Check one CLAUDE.md into git, add a rule whenever Claude repeats a mistake, tag @claude on review to capture learnings, start in Plan mode, and give Claude a way to verify its own work.
Keep a Claude Code session running on a remote box and steer it from your phone
Run Claude Code inside tmux on a server, use mosh for flaky links, connect Remote Control so you can steer and approve from your phone, and keep your SSH keys out of the agent's reach.
Ship AI-written code you can still explain: own the design, make the agent show its assumptions
Decide the abstractions yourself, pin them in a sketch or diagram, have the agent describe every change and flag what it assumed, then ask it to explain the diff before you commit.
Turn a checklist you keep forgetting into a Claude Code skill
When you catch yourself re-typing the same multi-step instructions, put them in .claude/skills/<name>/SKILL.md and run them with a slash command.