The notice says enabling SSH requires admin rights the extension usually lacks, so the attacker likely could not log in through the tunnel on most hosts, but the key was added, persistence installed and host details sent, so remediation is still needed.

The exact words it rests on

turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker. Follow the remediation steps below regardless.

What the source said when we opened it, on 31 Oct 2026.

The source

Security notice: malicious Anthropic.claude-code versions in the Cursor VS Code Extension Marketplace
Cursor · 2026-10-29

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 31 Oct 2026, against the source above.

In the story

Cursor says Claude Code 2.1.312 and 2.1.313 on its marketplace were malicious and attempted to add an SSH key. 31 Oct 2026