Back to blog
Claude Code Extension Backdoor: Why Uninstalling Isn't Enough

Claude Code Extension Backdoor: Why Uninstalling Isn't Enough

October 31, 2026
By Admin

Claude Code Extension Backdoor: Why Uninstalling Isn't Enough

For about eleven hours on October 29, Cursor's extension marketplace served a backdoored build of the Claude Code extension. The tampered versions, 2.1.312 and 2.1.313, were live between roughly 2:27am and 1:35pm PT on Windows and macOS. Anthropic didn't build them.

If you use Cursor, read this before you do anything else. The Claude Code extension backdoor plants persistence that outlives the extension. Removing or updating it does nothing to that part.

Cursor's security notice, updated October 30 at 11:30am PT, lists everything you need to check. Here's what it says, minus the panic.

Technical Breakdown: What the Claude Code Extension Backdoor Did

Someone slipped a malicious loader in front of the real extension code. You got working Claude Code, plus a passenger. Nobody has said publicly how this Cursor marketplace malware got in.

According to Cursor's notice, the payload did four things:

  • Sent machine data to the attacker. Hostname, username, OS, architecture, home directory, environment variable names, working directories, your Git email and public IP.
  • Added an SSH key. It appended the svc-telemetry SSH key to your authorized_keys file.
  • Tried to open a reverse SSH tunnel. It retried roughly every 60 seconds. This needs admin rights, so Cursor says it would fail on most hosts.
  • Set up persistence. A LaunchAgent on macOS, a scheduled task on Windows.

That last point is why uninstalling isn't enough. The persistence scripts live outside the extension folder and keep running after it's gone.

The bright spot: the attacker's server is offline now. Cursor had the hosting provider take it down. That doesn't make an open door on your machine safe.

Indicators of Compromise to Check

Start with the SSH key. It's the fastest check:

grep svc-telemetry ~/.ssh/authorized_keys

On Windows, check %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. Any hit means you were affected.

macOS files and services:

  • ~/Library/LaunchAgents/com.apple.sysmond.plist (label com.apple.sysmond)
  • ~/.config/.smt and ~/.config/.smtk
  • $TMPDIR/.stk_ followed by 10 hex characters

Windows files and services:

  • A scheduled task named SysMon
  • %USERPROFILE%\.config\smt.cmd and %USERPROFILE%\.config\smtk
  • %TEMP%\.stk_ followed by 10 hex characters
  • A fallback sysmon.cmd in your Startup folder

Network: connections to 134.209.82.225, including SSH on port 22 and a POST to /beacon on port 8099. Lookups to ifconfig.me or api.ipify.org alone don't prove anything.

Processes: look for ssh -N -R or autossh -M 0 running in the background. Also look for systemsetup -setremotelogin on in process or command-line logs on macOS, or an OpenSSH Server capability you never installed on Windows.

Cursor's notice also lists SHA-256 hashes for the payload and each tampered VSIX. Security teams should pull those straight from the notice.

On a Mac, this one-liner sweeps the main file and process indicators in one go. Empty output is what you want:

grep -s svc-telemetry ~/.ssh/authorized_keys; ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk 2>/dev/null; find "$TMPDIR" -maxdepth 1 -name '.stk_*' 2>/dev/null; pgrep -fl 'ssh -N -R|autossh'

Notice the naming pattern: svc-telemetry, com.apple.sysmond and SysMon are all dressed up as boring system monitoring. Apple's own launch agents normally live under /System/Library, not your user ~/Library/LaunchAgents folder, so a com.apple.* file there deserves a hard look. That habit will catch the next one too.

The Version Number Trap

Here's a detail that's easy to miss. Version 2.1.312 is also a real, legitimate Claude Code release in Anthropic's own changelog. The attacker reused a genuine version number.

So do I have 2.1.312? is the wrong question, because a clean install from Anthropic's official channels carries the same number. The same goes for Claude Code 2.1.313. What matters is where it came from: Cursor's marketplace, on macOS or Windows, during that window.

This cuts both ways: don't panic if you installed 2.1.312 somewhere else. And don't relax because your version matches a real release. Version numbers prove nothing about what's inside a package.

Cleaning Up: The Order Matters

Cursor published two remediation scripts, linked from its security notice. Here's the order we'd follow:

  1. Check for the key using the grep above.
  2. Isolate the machine if you found anything, and seriously consider a rebuild.
  3. On macOS, run bash remediate-macos.sh as the affected user. Not as root.
  4. On Windows, open an admin PowerShell and run powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1.
  5. Rotate credentials from a different, trusted machine. Git tokens, cloud keys, API keys, anything whose environment variable name was on that box.
  6. Only then update the extension. Anthropic's changelog lists a clean 2.1.314.

Credential rotation is the step people skip. Cursor says the payload sent environment variable names, not values, but an attacker who got SSH access could read the values directly. If you found anything, assume what's on that machine is burned.

Questions go to security@cursor.com.

Real-World Impact: Who's Affected and Who Isn't

The Hacker News reports that Cursor said on X the incident hit at most 5,000 users. That number isn't in the notice itself.

Cursor says it found no evidence that other versions of the extension or the official distribution are affected. It shut the marketplace down, audited it, found no other tampered extensions, rotated keys and rebuilt it. The Hacker News also issued a correction: Open VSX wasn't affected, despite early reports.

Put plainly: the tampered builds came from Cursor's marketplace, on macOS and Windows, in that window. If you got Claude Code from Anthropic's official distribution, Cursor found no evidence you were hit, though running the five-second check above costs nothing.

Hard Limitations of the Response So Far

No root cause yet. Cursor hasn't explained how a tampered build reached its marketplace. Until it does, you can't judge whether the hole is closed or just this one attack.

Eleven hours is a long window. Coding extensions run with your full user permissions. Any extension marketplace that can serve a bad build for most of a working day is a single point of failure for every developer on it.

Remediation is on you. Cursor pulled the bad versions from its marketplace but hasn't described any automatic cleanup of installed copies. If you installed during the window and never read the notice, the LaunchAgent or scheduled task is probably still sitting there.

Verdict: Your Developer Action Plan

Run the grep today, even if you think you're fine. It takes five seconds.

If it hits, isolate the machine, run Cursor's cleanup script, rotate credentials from a clean machine, and only then update. Updating first leaves the persistence in place.

Longer term, treat AI coding extensions like any other dependency with shell access, because they read your repo, your environment and your keys. Check your editor's extension auto-update setting, pin versions on machines that hold production credentials, and watch your authorized_keys file. That's one file you rarely look at and attackers love to write to.