What happened?
Cursor reported that Anthropic.claude-code versions 2.1.312 and 2.1.313 downloaded from its marketplace between 2:27 a.m. and 1:35 p.m. Pacific time on October 29, 2026 were malicious. Anthropic did not develop the tampered packages. Cursor and Microsoft report no evidence that the official Microsoft Visual Studio Marketplace or npm distributions were affected by this incident.
What did the payload attempt?
The injected code gathered host information and attempted to append an attacker-controlled SSH key to authorized_keys, enable the local SSH service and establish a reverse SSH tunnel. It also set up persistence through a macOS LaunchAgent or Windows scheduled tasks and startup scripts. SSH activation failed on most machines without administrative privileges, but persistence artifacts could remain. Cursor reports that the attacker-operated server was taken offline.
Who needs to check?
Focus on macOS and Windows systems that installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from Cursor’s marketplace during the reported window. Using Claude Code alone does not establish compromise; the package source and exact version matter.
A safe initial check
Cursor identified svc-telemetry as a marker associated with the unauthorized SSH key. On macOS, inspect ~/.ssh/authorized_keys. On Windows, review %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys, when present. No match does not prove the host is clean. Review installation history, persistence artifacts and endpoint telemetry using the vendor’s full guidance.
How to respond to a potentially affected system
- Preserve evidence: record installed versions and retain relevant logs and artifacts before cleanup.
- Isolate affected devices when payload execution or backdoor installation is suspected.
- Follow Cursor’s official remediation to remove the malicious extension, unauthorized key and persistence mechanisms. Uninstalling the extension alone may not be sufficient. Review official scripts before use and follow platform privilege instructions.
- Review credentials and sessions for GitHub, SSH and cloud services; revoke potentially exposed access from a trusted device.
- Consider rebuilding devices where compromise is confirmed or cannot be confidently ruled out.
The software supply-chain lesson
Editor extensions run code on developer machines, often alongside Git credentials, SSH keys and access to sensitive projects. Security depends on the exact artifact and its distribution source, not only the extension name. Extension inventories and developer endpoints must be part of patch management and incident response.
Official sources
Published November 2, 2026.