If you installed or updated the Claude Code extension inside Cursor on October 29, 2026, run two commands before anything else: one looks for the svc-telemetry SSH key in your authorized_keys, the other looks for the persistence file the malicious code left behind. If either finds something, run Cursor's official cleanup script and rotate your credentials from a different machine. Uninstalling the extension is not enough.
Below are the exact commands for macOS, Windows and Linux, taken from Cursor's security notice and from the cleanup scripts Cursor published.
What happened to the Claude Code extension in Cursor?
Cursor's extension marketplace served tampered builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313, for macOS and Windows, for about 11 hours. According to Cursor's security notice (published Oct 29 and updated Oct 30, 2026), these versions "were not developed by Anthropic".
| Item | What is known | Source |
|---|---|---|
| Tampered versions | 2.1.312 and 2.1.313 (darwin-arm64 and win32-x64) | Cursor, Oct 30 update |
| Window | Oct 29, 2026, from 2:27am to 1:35pm Pacific Time (09:27 to 20:35 UTC) | Cursor |
| Who may have received it | up to 5,000 users | BleepingComputer and OX Security, citing Cursor |
| Affected channel | only Cursor's marketplace. Cursor says it has no evidence that other versions or the official distribution were affected | Cursor |
| Attacker server | offline, taken down together with the cloud provider | Cursor |
| Versions before 2.1.312 | not on any affected list | Cursor, OX, Phorion |
If you only use Claude Code from the terminal, or installed the extension from Microsoft's marketplace in VS Code, nothing in the sources above points to exposure.
What did the malicious code do on the machine?
It sent machine details to the attacker and tried to open an SSH way in. Per Cursor's description, in four stages:
- Collection: hostname, username, OS, architecture, home directory, environment variable names, working directories, Git email and public IP.
- Attacker key: appended an
ssh-ed25519key with the commentsvc-telemetryto~/.ssh/authorized_keys. - Reverse tunnel: tried to enable local SSH and open an
ssh -N -Rtunnel to the attacker's server. Cursor says that, due to bugs in the malicious code itself, this step failed unless Cursor was running with administrator privileges. - Persistence: a LaunchAgent on macOS, a scheduled task (with a Startup script fallback) on Windows, and scripts that tried to rebuild the tunnel roughly every 60 seconds.
Phorion, which analyzed the code, recorded that the environment variable filter was /KEY|TOKEN|SECRET|PASS|AWS|GCP/i and that only names were sent, not values. That helps decide what to rotate first, as shown below.
How do I know if my machine was affected?
Look for the key and the persistence files. Do not trust the version number: Cursor's official script notes that the tampered bundle "keeps the real version number", so it detects by the content of extension.js, and so should you.
macOS and Linux
# 1. Tampered extension installed? (looks for the marker inside the code)
grep -l svc-telemetry ~/.[!.]*/extensions/anthropic.claude-code-*/extension.js 2>/dev/null
# 2. Attacker key, by comment and by fingerprint
grep -c svc-telemetry ~/.ssh/authorized_keys
ssh-keygen -lf ~/.ssh/authorized_keys | grep 0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
# 3. Persistence
ls -la ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null
ls -a "${TMPDIR:-/tmp}" /tmp | grep '^\.stk_'
crontab -l 2>/dev/null | grep '\.config/\.smt'Why the fingerprint on top of the comment: Phorion points out that a comment can be edited, the key cannot. SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk is the value Cursor and OX Security published for the planted key.
Linux is not on Cursor's list of affected builds, but the code has a routine for it (an @reboot crontab entry pointing to ~/.config/.smt), and Cursor lists those paths among its indicators. The last line covers that case.
Windows (PowerShell)
# 1. Tampered extension installed?
Get-ChildItem "$HOME\.*\extensions\anthropic.claude-code-*\extension.js" -Force -ErrorAction SilentlyContinue |
Select-String svc-telemetry -SimpleMatch -List
# 2. Attacker key (command published by Cursor)
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }
# 3. Persistence
schtasks /query /tn SysMon
Test-Path "$HOME\.config\smt.cmd", "$HOME\.config\smtk", "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"If schtasks says it cannot find the task and all three Test-Path results are False, the persistence is not there.
How do I clean up if I found the key or the files?
Run Cursor's official script. It unloads the persistence, kills the tunnel processes, deletes the tampered extension, removes the dropped files and takes the key out of authorized_keys. It exits with code 1 if anything is left behind.
# macOS: run as the affected user, WITHOUT sudo (the script refuses root)
curl -fsSLO https://cursor.com/static/security/claude-code-extension/remediate-macos.sh
less remediate-macos.sh
bash remediate-macos.sh# Windows: close all editors and open PowerShell with "Run as administrator"
Invoke-WebRequest https://cursor.com/static/security/claude-code-extension/remediate-windows.ps1 -OutFile remediate-windows.ps1
powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1The expected output is clean: no backdoor found (nothing was there) or done: backdoor removed. If you see incomplete, read the warnings above that line and run it again after closing your editors. The Windows script cleans every user profile on the machine; the macOS one has to run once per affected user.
Do not delete the line with sed '/svc-telemetry/d'. Both Cursor scripts explain why: the attacker key was appended "without a leading newline", so it may share a line with one of your legitimate keys. Deleting the whole line removes your access too. The script removes only the exact key string.
On macOS, if the script reports that something listens on localhost:22 and you do not use inbound SSH on that machine, turn Remote Login off: sudo systemsetup -setremotelogin off.
On Linux there is no official script. Remove the crontab entry and the files by hand, and check that your other jobs are still there (Phorion flagged a bug in the malicious code that can wipe existing cron jobs):
crontab -l | grep -v '\.config/\.smt' | crontab -
rm -f ~/.config/.smt ~/.config/.smtk /tmp/.stk_*
crontab -lDoes uninstalling the extension from Cursor fix it?
No. Cursor writes that uninstalling "may not be sufficient", because the persistence scripts run on their own, outside the editor. Updating the extension does not remove the key or the LaunchAgent either. You need the cleanup from the previous section.
Which credentials should I rotate first?
Everything the affected machine could reach, and from a different machine. Cursor's literal recommendation is to "rotate credentials and sessions accessible from affected hosts, from a trusted system", because the names-only collection "does not rule out later credential access over the backdoor".
To prioritize, see which names the malicious filter would have caught in your environment:
env | cut -d= -f1 | grep -iE 'KEY|TOKEN|SECRET|PASS|AWS|GCP'| What to rotate | Why |
|---|---|
| Everything the command above printed | Name sent to the attacker, value reachable through the tunnel |
SSH keys in ~/.ssh | The tunnel gave access to the disk |
GitHub token (gh, Git Credential Manager) and npm | Same reason, and your Git email was sent |
| Cloud credentials (AWS, GCP, Azure) | They live in files under home, not only in variables |
| Browser sessions for critical accounts | Cursor says "credentials and sessions" |
If the tunnel actually opened (key found and local SSH enabled), Cursor recommends isolating the machine and considering a reinstall.
Quick questions
I only use Claude Code in the terminal. Do I need to do anything?
Based on current sources, no. The incident was in Cursor's extension marketplace. Running the key grep takes one second and settles it.
My extension is on a version newer than 2.1.313. Am I safe?
The new extension does not carry the malicious code, but if 2.1.312 or 2.1.313 ever ran, the key and the persistence stayed behind. Run the check anyway.
The attacker server is down. Do I still need to clean up?
Yes. The key is still authorized in your authorized_keys and the persistence script keeps trying to open the tunnel. A server that is down today does not stop another one tomorrow.
If you want a backup coding agent in the terminal while you review your editor extensions, Verboo Code runs as a CLI, with unlimited tokens.
