Fake Claude Code extension in Cursor’s marketplace: how to check whether your computer has the backdoor

If you use Claude Code inside Cursor and you installed or updated the extension on October 29, 2026, check your computer. For about 11 hours, Cursor’s marketplace served a fake copy of the Claude Code extension, versions 2.1.312 and 2.1.313. The fake copy tries to add the attacker’s SSH key, svc-telemetry, to the list of who can log into your computer, and installs itself to restart every time the machine boots. Two commands tell you whether you’re affected, and a script from Cursor cleans everything up.

What happened in Cursor’s marketplace?

On October 29, 2026, from 2:27am to 1:35pm Pacific Time (9:27 to 20:35 UTC), Cursor’s extension marketplace served versions 2.1.312 and 2.1.313 of Anthropic.claude-code for Mac and Windows. Cursor says so in its security notice. Anyone who installed or updated the Claude Code extension in that window is potentially affected.

Cursor’s notice doesn’t say how many people were hit. The Register reports estimates from security experts of up to 5,000 developers.

Anthropic did not develop those versions. Cursor’s notice states this explicitly. Felix Rieseberg of Anthropic added that the incident did not touch Anthropic’s systems: someone used access to Cursor’s marketplace to publish a tampered copy of the extension.

What does the fake extension do to your computer?

The fake Claude Code extension kicks in as soon as you open Cursor, with no action on your part. According to Cursor’s notice, it:

• collects information about the computer and the user (hostname, username, operating system, public IP, Git email) and sends it to the attacker;
• tries to add the attacker’s SSH key, labeled svc-telemetry, to ~/.ssh/authorized_keys, the list of keys allowed to log into your computer without a password;
• opens a tunnel to the attacker and makes it persistent: a LaunchAgent on Mac, a scheduled task on Windows.

This is a backdoor: a malicious program that restarts every time the computer boots. If you shut down and restart, the attacker’s access stays.

Cursor notes that turning on the SSH service requires administrator rights, so that step probably failed on most computers. The other actions may still have succeeded. That’s why uninstalling the extension is not enough: the key and the persistence stay behind.

How do I check whether my computer was exposed?

Open a terminal and run two commands. If you prefer, ask Claude Code to run them for you.

1. Check which version of the extension you have.

cursor --list-extensions --show-versions | grep -i claude

If the line it prints shows 2.1.312 or 2.1.313, move on to the next check.

1. Look for the attacker’s key.

grep svc-telemetry ~/.ssh/authorized_keys

If the command prints nothing, you’re fine. If a line with svc-telemetry comes out, you have the backdoor and the computer must be treated as compromised.

On Windows, Cursor says to search for svc-telemetry in two files: %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys.

How do I remove the backdoor?

Cursor published a script that checks everything and, if it finds the backdoor, removes it. The script deletes the fake extension, the persistence, the tunnel processes and the attacker’s key. On Mac you run it from the terminal as your normal user, without sudo:

curl -fsSLO https://cursor.com/static/security/claude-code-extension/remediate-macos.sh
bash remediate-macos.sh

I ran it on my Mac and it came back clean. On Windows the equivalent script is remediate-windows.ps1, linked from the same notice, to be run in PowerShell opened as administrator.

If the script says it removed the backdoor, change your passwords, tokens and keys right away, and do it from another computer. That’s also Cursor’s guidance: rotate the credentials and sessions reachable from the affected computer, starting from a trusted system.

What did Cursor do, and what is still unknown?

Cursor pulled the malicious extension and temporarily shut down the whole marketplace as a precaution. It then rotated its keys, rebuilt the marketplace and brought it back online. It also says it verified that no other extension had been tampered with.

Cursor has not explained how the fake copy got into the marketplace. In practice, nobody knows who the attacker is.

What should you do now?

If you use Claude Code inside Cursor, the two checks take a minute. If you know someone who works with Cursor, send them these commands: one minute is all they need to know whether their computer is clean.