GLOBAL – October 30, 2026 -- A maliciously modified build of the Anthropic.claude-code extension, version 2.1.313, sat in the Cursor VS Code Extension Marketplace for about 11 hours on October 29, 2026, potentially exposing up to 5,000 users, according to Cursor. Anthropic did not develop the malicious version.

Payload plants an attacker SSH key and persistence on developer machines

The extension was live between roughly 2:27 AM and 1:35 PM PT. It collected host and user data, appended an attacker-controlled ssh-ed25519 key labeled svc-telemetry to the user's authorized_keys file, and installed persistence. It also attempted to enable the local SSH service and open a reverse SSH tunnel to an attacker server over TCP port 22.

The reconnaissance stage gathered hostname, username, operating system, architecture, home directory path, environment variable names, working directories, configured Git email and public IP address. Lookups to ifconfig.me and api.ipify.org are legitimate services and should not be treated alone as indicators of compromise, Cursor said.

Failed SSH-service step limited tunnel access, but the key and persistence remained

Enabling the local SSH service requires administrator privileges, which the extension typically lacks. Errors in the malicious code meant this step failed except in highly unusual cases where Cursor was launched with administrator privileges, so the attacker could not log in through the tunnel on most hosts.

The payload still wrote the SSH key, installed persistence and sent host details to the attacker. Reporting went via HTTP POST to port 8099 on the attacker's server.

Persistence scripts retry the tunnel every 60 seconds and survive uninstallation

Background scripts retry the reverse tunnel approximately every 60 seconds, independent of the extension.

• macOS: a LaunchAgent named com.apple.sysmond.plist, plus files including ~/.config/.smt and ~/.config/.smtk.
• Windows: a scheduled task named SysMon that attempts to run as SYSTEM, with a fallback Startup script named sysmon.cmd.

Uninstalling the extension may therefore not be sufficient to remove the threat.

Cursor rebuilt its marketplace, rotated keys and took the attacker server offline

Cursor removed the malicious version, shut down and rebuilt the marketplace, and rotated its keys. It worked with the hosting provider to take the attacker server offline, which disabled the external beacon and reverse tunnel. Its access audit found no evidence that other extensions were tampered with, and no evidence that other versions of the extension or Anthropic's official distribution were affected.

Affected users must check for the svc-telemetry key and rotate credentials

Anyone who installed or updated to version 2.1.313 during the window should search authorized_keys for the svc-telemetry key. On Windows, that includes C:\ProgramData\ssh\administrators_authorized_keys. If the key is present, the machine is impacted.

Cursor's guidance for affected hosts:

• Isolate systems showing payload execution or backdoor installation.
• Remove the unauthorized key, persistence mechanisms and running tunnel processes, and assess whether to rebuild the host.
• Rotate credentials and sessions reachable from affected hosts, from a trusted system.

The limited environment-variable collection does not rule out later credential access through the backdoor.

Attack required no click and no exploited vulnerability

The build was published under the real Anthropic.claude-code name and arrived through the editor's own marketplace. A poisoned update to a trusted extension amounts to code execution on the developer's machine, with write access to SSH keys, startup tasks and network tunnels.