SafetyPublished All news from that day
Cursor says Claude Code 2.1.312 and 2.1.313 on its marketplace were malicious and attempted to add an SSH key.
Cursor lists indicators and remediation steps for the two versions, which it says Anthropic did not develop.
Check our sources · 11 facts from 1 sourceCursor users who installed Anthropic.claude-code 2.1.312 or 2.1.313 on Windows or macOS from Cursor's extension marketplace should check their machines for an unauthorised SSH key labelled "svc-telemetry" and rotate credentials from a clean system.
Cursor's security notice, published on 29 October 2026 and updated on 30 October, says the two versions were available from about 2:27am to 1:35pm Pacific time on 29 October, and that they "were not developed by Anthropic".
Per the notice, the code collects host and user details, tries to add an attacker's SSH key, enable the local SSH service and open a reverse tunnel, and installs persistence through a LaunchAgent on macOS or a scheduled task on Windows.
Cursor says enabling SSH needs admin rights the extension usually lacks, so the attacker likely could not log in on most hosts, but the key and persistence may still be installed. It says the attacker's server no longer functions and the host took it offline.
Cursor says the malicious version was removed and the marketplace was shut down, rebuilt and brought back. The notice gives file hashes, network indicators and a remediation script for each system, and advises considering a rebuild of affected hosts because uninstalling the extension may not be enough.
The notice does not say how many users installed it, how the builds got onto the marketplace, how the incident was found, or which version is clean.
Underlined sentences link to the facts we checked. Dotted words open a short explainer.
Fact 7 of 11 · from Cursor, 29 Oct 2026
turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker. Follow the remediation steps below regardless.
Fact 9 of 11 · from Cursor, 29 Oct 2026
Removed the malicious version from the Cursor VS Code Extension Marketplace immediately upon detection and blocked further distribution. We followed with a full shut down of the marketplace out of an abundance of caution.
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against this source.
1 Security notice: malicious Anthropic.claude-code versions in the Cursor VS Code Extension Marketplace
Open the source archived copy-
Cursor's security notice was published on 29 October 2026 by the Cursor Team and updated on 30 October 2026 at 11:30am PT to update the indicators and clarify affected versions.
citeOct 30, 2026, 11:30 am PT: We updated the IOCs and clarified affected versions.
-
The notice names Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS in the Cursor VS Code Extension Marketplace as malicious.
citeAnthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS . These malicious versions of the extension were not developed by Anthropic.
-
The notice says the malicious versions were available between about 2:27am PT and 1:35pm PT on 29 October 2026.
citeBetween about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace.
-
The notice says the malicious versions "were not developed by Anthropic".
citeThese malicious versions of the extension were not developed by Anthropic.
-
The notice says the code collects host and user information (hostname, username, OS, architecture, home directory, environment variable names, working directories, Git email, public IP).
citeCollects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.
-
The notice says the code attempts to add an attacker-controlled SSH key (comment "svc-telemetry") to authorized_keys, enable the local SSH service and open a reverse SSH tunnel, and attempts persistence via a LaunchAgent on macOS or a scheduled task running as SYSTEM on Windows.
citeAttempts to make the reverse SSH tunnel persistent via a LaunchAgent (macOS), or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows).
-
The notice says enabling SSH requires admin rights the extension usually lacks, so the attacker likely could not log in through the tunnel on most hosts, but the key was added, persistence installed and host details sent, so remediation is still needed.
citeturning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker. Follow the remediation steps below regardless.
-
The notice says the attacker server no longer functions and the hosting provider took it offline.
citeNote: The attacker server no longer functions. We worked with the cloud provider that was hosting it to take it offline
-
The notice says the malicious version was removed, and the marketplace was fully shut down, rebuilt and brought back online.
citeRemoved the malicious version from the Cursor VS Code Extension Marketplace immediately upon detection and blocked further distribution. We followed with a full shut down of the marketplace out of an abundance of caution.
-
The notice recommends checking for the svc-telemetry key, isolating affected hosts, removing the key, persistence and tunnel processes, considering a rebuild because uninstalling the extension may not be enough, rotating credentials from a trusted system, and running its remediation scripts.
citeUninstalling the extension may not be sufficient
-
The notice does not state how many users were affected, how the incident was discovered, any CERT or external alert, or a clean fixed version.
citeToday we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace
Every sentence above is checked against this source. Each fact has its own address you can cite.
Source 1 · Cursor · 29 Oct 2026
Security notice: malicious Anthropic.claude-code versions in the Cursor VS Code Extension Marketplace
Cursor's security notice was published on 29 October 2026 by the Cursor Team and updated on 30 October 2026 at 11:30am PT to update the indicators and clarify affected versions.
Oct 30, 2026, 11:30 am PT: We updated the IOCs and clarified affected versions.
The notice names Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS in the Cursor VS Code Extension Marketplace as malicious.
Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS . These malicious versions of the extension were not developed by Anthropic.
The notice says the malicious versions were available between about 2:27am PT and 1:35pm PT on 29 October 2026.
Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace.
Show all 11 factsShow fewer facts
The notice says the malicious versions "were not developed by Anthropic".
These malicious versions of the extension were not developed by Anthropic.
The notice says the code collects host and user information (hostname, username, OS, architecture, home directory, environment variable names, working directories, Git email, public IP).
Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.
The notice says the code attempts to add an attacker-controlled SSH key (comment "svc-telemetry") to authorized_keys, enable the local SSH service and open a reverse SSH tunnel, and attempts persistence via a LaunchAgent on macOS or a scheduled task running as SYSTEM on Windows.
Attempts to make the reverse SSH tunnel persistent via a LaunchAgent (macOS), or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows).
The notice says enabling SSH requires admin rights the extension usually lacks, so the attacker likely could not log in through the tunnel on most hosts, but the key was added, persistence installed and host details sent, so remediation is still needed.
turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts. On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker. Follow the remediation steps below regardless.
The notice says the attacker server no longer functions and the hosting provider took it offline.
Note: The attacker server no longer functions. We worked with the cloud provider that was hosting it to take it offline
The notice says the malicious version was removed, and the marketplace was fully shut down, rebuilt and brought back online.
Removed the malicious version from the Cursor VS Code Extension Marketplace immediately upon detection and blocked further distribution. We followed with a full shut down of the marketplace out of an abundance of caution.
The notice recommends checking for the svc-telemetry key, isolating affected hosts, removing the key, persistence and tunnel processes, considering a rebuild because uninstalling the extension may not be enough, rotating credentials from a trusted system, and running its remediation scripts.
Uninstalling the extension may not be sufficient
The notice does not state how many users were affected, how the incident was discovered, any CERT or external alert, or a clean fixed version.
Today we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep