Cursor’s malicious Claude Code extension attempted persistent SSH access

Two versions from one marketplace

Cursor’s notice identifies Anthropic.claude-code 2.1.312 and 2.1.313 for macOS and Windows, served on October 29, 2026, from approximately 2:27 a.m. to 1:35 p.m. Pacific Time. Both manual installation and automatic updates matter. An extension displaying Anthropic’s name does not, by itself, establish where that package came from.

Cursor says Anthropic did not develop these malicious versions. Microsoft confirms that the compromised packages were not distributed by Visual Studio Marketplace or the npm package @anthropic-ai/claude-code. The evidence available to Microsoft points to an incident limited to Cursor’s marketplace. This is not a finding that every Claude Code installation was compromised.

The incident occurred on October 29, with analyses published afterwards. SecuFocus first published this explainer on November 2. The current notice names two affected versions, not just 2.1.313.

Loading the extension is enough to trigger the code

Microsoft and Phorion describe JavaScript prepended to extension.js. It runs as the module loads, before normal extension initialisation. A user does not have to start a conversation with Claude to trigger this payload.

The code attempts to add a key to the workstation’s SSH authorised keys, enable its SSH service and establish an outbound reverse tunnel. That connection could give an attacker a route back to the workstation’s SSH service. Success depends on privileges, existing services and configuration at both ends.

The payload also gathers host and user information, public IP address, configured Git email and names of environment variables associated with sensitive access. The researchers distinguish variable names from secret values: this reconnaissance alone does not establish that every API key on a workstation was stolen.

Broken SSH setup is not a clean bill of health

Cursor and the researchers describe coding errors and privilege restrictions which prevented SSH activation on many macOS and Windows systems. That limits the remote-access path, but does not undo earlier changes. Planted keys, reported host information and startup persistence still require investigation.

On macOS, the described persistence uses a LaunchAgent, a task running in the user’s session. On Windows, the code attempts a SysMon scheduled task and has a Startup-script fallback. Analysts also describe a Linux branch in the code. That capability does not, by itself, expand the macOS and Windows package distribution identified in Cursor’s notice.

Cursor says it removed the packages, audited and rebuilt its marketplace, rotated its own keys and had the attacker’s server taken offline. Taking down that server interrupts connections to it. It does not remove files or access entries already written to workstations.

Investigate without deleting evidence or legitimate access

Start with extension installation and update records: Cursor as the package source, the affected version and the installation window. Today’s installed version may not show what was present earlier. On a work device, pass these records to the person responsible for incident response.

The svc-telemetry marker can appear in SSH authorised-key files. Cursor’s notice provides package and key fingerprints; Microsoft recommends confirming the exact unauthorised entry before removing it. The absence of that marker alone is not a substitute for reviewing installation, file, process, network and persistence evidence.

Do not wipe the .ssh directory, the whole authorised-key list, tasks with names resembling SysMon or legitimate remote-development settings. Preserve evidence first and remove only confirmed malicious objects. SecuFocus has not executed the malware or examined your workstation.

• Read Cursor’s published indicators and remediation scripts↗

Uninstalling the extension may leave persistence behind

Isolate devices showing evidence of payload execution or backdoor installation, and preserve evidence before cleanup. The persistence scripts live outside the extension directory, so an uninstall or update may not remove them.

Response needs to cover tunnel processes, persistence scripts and startup entries, the unauthorised SSH key and associated identity files. Cursor provides platform-specific remediation scripts. Review their contents and execution requirements before using them rather than copying a generic cleanup from a comment.

Use a known-clean device to rotate credentials and revoke sessions identified as exposed by the investigation. Rebuild the workstation if trust cannot be restored. Keep attempted setup, persistence artifacts and a confirmed successful login separate in the incident record.

• Another software supply-chain incident: the compromised LiteLLM package↗
• Northflank reports unauthorised AI API-key use after a secrets breach↗