claude code extension backdoor: a fake Claude Code add-on in Cursor’s store tried to leave a spare login.
A bad copy of the Claude Code editor add-on sat in Cursor’s own extension store for about 11 hours on 29 October 2026. Cursor says it may have reached 5,000 people. It was built to leave a spare login on the computer. Anthropic says its own computers were not broken into, and that the copies on its own download pages were not the poisoned ones.
Checked November 2026 against Cursor’s advisory on the marketplace add-on and Anthropic’s statement that its own download pages were not the poisoned copies. The search steps below are the practical response.
If you do not use Cursor (the AI code editor), you can almost certainly stop after the next section. If you do use it, the check takes less time than reading this page.
Do this before the story
A computer can let another computer log in. The usual tool for that login is SSH (Secure Shell, a locked tunnel for typing commands on a machine that is not in front of you). Instead of a password, SSH can trust a key (a long random stamp, split into a public half you can show people and a private half you keep). The file that lists trusted public stamps is called authorized_keys. It is a guest list. A name on that list can come in.
The poisoned add-on tried to write one extra name onto that guest list. The name at the end of the line is svc-telemetry. That string is the thing you search for. You do not need to install anything to look.
On a Mac, open Terminal (the app where you type commands) and paste this. It only reads. It does not delete or change anything.
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"On Windows, open PowerShell (Windows’ command window) and paste this. Same idea: read only.
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }Those two lines are the check Cursor published. “No key found” is their wording, not a promise from me. There is a second, smaller look further down, for leftover startup files, because a script can be dropped even when the guest-list edit fails.
Two products share one name
Claude Code is Anthropic’s coding agent (a program that reads a project and edits it when you ask). People meet it in two places, and the difference matters here.
One place is the terminal program. Many people install that with npm (Node’s package downloader, the tool behind npm install). That package is @anthropic-ai/claude-code. Socket, a company that watches package registries (the public lists of downloadable software), said it found no publish record for a poisoned 2.1.313 on npm.
The other place is an extension (a plugin, a small program the editor loads on top of itself). The editor in this story is Cursor, which is a fork of VS Code (Microsoft’s free code editor, copied and changed). The plugin’s id is Anthropic.claude-code. Loading that plugin is enough. You do not have to start a Claude chat. The bad code ran as soon as the editor loaded the file.
Same brand. Different pipes. The poison was in one pipe.
A marketplace is just a store
An editor does not invent every plugin. It downloads them from a marketplace (a store of plugins, with version numbers and an update button). There is more than one store for this plugin.
- Microsoft’s Visual Studio Marketplace is the store inside ordinary VS Code.
- Open VSX is a second public store, run by the Eclipse Foundation, used by some editors that are not Microsoft’s.
- Cursor runs its own store for Cursor.
A clean file in store A does not prove the file in store B is clean. That is the whole incident.
Anthropic staff, writing on Hacker News on 30 October, said the official VS Code store and Open VSX were not hit. Cursor said it has no evidence that other versions, or “the official distribution,” were affected. StepSecurity and the macOS security firm Phorion described the bad build as also appearing on Open VSX. Socket said it could not find a 2.1.313 publish or removal record on Open VSX. Those accounts disagree. What they agree on is the store you should worry about first: Cursor’s.
Nobody in the public record, as of 31 October 2026, has explained how the file got into that store. Do not fill the gap with a guess.
What actually happened on Thursday
On 29 October 2026, between about 2:27 a.m. and 1:35 p.m. Pacific time, Cursor’s marketplace offered a modified Claude Code extension. Cursor’s notice, updated at 11:30 a.m. Pacific on 30 October, names two versions for Windows and macOS: 2.1.312 and 2.1.313. Many news stories mention only 2.1.313. Use Cursor’s updated list. They are the ones who hosted the file, and they published separate file hashes (fingerprints of the exact bytes) for both.
Cursor says at most 5,000 users were in range. It removed the versions, took the whole marketplace offline, audited it, rotated keys (replaced the secret stamps the store itself uses), rebuilt the store, and brought it back. It says other extensions on that store were not changed. It also says it worked with the attacker’s hosting company to take the attacker’s server offline. Reuters reported the same window, the same 5,000 cap, and the same “not developed by Anthropic.”
Felix Rieseberg, posting as Anthropic, wrote: a malicious actor used access to Cursor’s marketplace to publish a tampered copy, which Anthropic did not build or publish. It was not a compromise of Anthropic’s systems or employee laptops. The versions on Anthropic’s own channels were not affected. Dworken, also posting as Anthropic, said the same and added that VS Code users were not impacted.
So the headline “Anthropic was hacked” is the wrong shape. The honest headline is narrower and more useful: a store that uses Anthropic’s name served a file Anthropic says it did not ship.
What the file tried to do, in order
A backdoor (a hidden extra way in, left by someone who is not you) needs three jobs. Get a login. Keep that login after a reboot. Phone home.
First the file collected a description of the machine: hostname (the computer’s name), username, operating system, chip type, home folder, the names of environment variables (settings the shell can see, sometimes including the names of tokens), working folders, the git email, and the public IP address (the address your network shows the rest of the internet). Cursor’s notice lists that set. Help Net Security, citing Phorion, says it sent names of up to about 40 environment variables that looked like secrets, not necessarily the secret values themselves. I am not treating those two descriptions as the same fact. The cautious reading is: it tried to describe the machine, and a description can be enough to aim a later visit.
Second, it tried to append its own SSH public key to authorized_keys, with the comment svc-telemetry. The fingerprint Cursor published for that key is SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk. A fingerprint is a short hash of the key. You can match it without pasting the attacker’s key into anything. Do not add any key you find in a writeup. You are only supposed to search for one that is already on your machine.
Third, it tried to turn on the local SSH service, so the guest list would actually be consulted. On a Mac that service is Remote Login. On Windows it is the OpenSSH Server feature. Then it tried to open a reverse tunnel (your computer calls the attacker, and the attacker walks back through that call). Firewalls (rules that block strangers from knocking on your ports) usually stop an incoming knock. They often allow an outgoing call. A reverse tunnel uses that allowance. The call was aimed at 134.209.82.225 on port 22, with retries about every 60 seconds. A separate beacon (a short “I am here” message) went to port 8099 on that same address. Cursor says that server no longer works.
The payload lived at the start of extension.js (the big file the extension runs). One published hash for that file is ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. StepSecurity said the bad file was about 7 KB larger than the clean release before it, and that it ran under plain Node (the JavaScript engine) with no need for a Claude conversation. Those hashes are from Cursor’s notice and from researchers who say they matched it. If your only copy is whatever Cursor reinstalled after the rebuild, a hash of today’s file will not match the bad hash, which is what you want.
Why the door often did not open
Cursor’s notice says a key step failed on ordinary machines. Outside the unusual case where Cursor itself was started with administrator rights (the highest permission on the computer, allowed to change system settings), errors in the malicious code meant the attempt to enable SSH and hold the tunnel open would fail. Reuters reported that same limit.
Read that carefully. “The tunnel step failed” is not the same sentence as “nothing was written.” The guest-list edit is a write into your own home folder. That does not need to be an administrator. Turning on a system SSH service usually does. Phorion’s point, via Help Net Security, is the edge that matters: if Remote Login was already on, the new key alone can be enough, even when the “please turn SSH on” step crashes.
That is why the search above is the test, not a feeling about whether you clicked Allow.
Uninstalling the add-on does not pull the key out
Persistence (a way for a program to start again after you quit it, or after a reboot) was the other half of the job. The extension can be gone and the leftover can still be there. Cursor says this in so many words: uninstalling may not be enough, because the payload drops standalone scripts.
The leftovers they named:
| Where | What to look for | What that thing is |
|---|---|---|
| Mac and Linux | ~/.ssh/authorized_keys containing svc-telemetry | The guest list |
| Windows | %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys | The guest list, including the one administrators share |
| Mac | ~/Library/LaunchAgents/com.apple.sysmond.plist | A LaunchAgent, macOS’s “run this when I log in” file. The label imitates a system monitor. |
| Windows | Scheduled task named SysMon, and a Startup-folder script sysmon.cmd | A scheduled task is Windows’ “run this on a timer or at boot.” The Startup folder runs whatever is in it at login. |
| Linux | A cron line @reboot pointing at ~/.config/.smt | Cron is the old Unix timer. @reboot means “when the machine starts.” |
| All three | ~/.config/.smt, ~/.config/.smtk, and on Windows %USERPROFILE%\.config\smt.cmd | Scripts and a small key file the payload wrote for itself |
| Temp folders | .stk_ plus random hex characters | A dropped tunnel key. Cursor’s fingerprint for that key is SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ |
The names are camouflage. sysmon and com.apple.sysmond sound like the operating system watching itself. Apple does not put a LaunchAgent of that name in your user Library for this. svc-telemetry sounds like a boring diagnostic account. Boring is the point.
A second look, still read-only:
ls -l ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk 2>/dev/null
crontab -l 2>/dev/null | grep -n smt || trueGet-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue
Test-Path "$HOME\.config\smt.cmd"
Test-Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"If the key search was clean and these files are absent, you have done the check a normal person can do without a forensics lab. If either search hits, the quick test is over and the careful one begins.
Which version numbers, and which stores
Version numbers collided, and that collision is why smart people argued past each other.
A clean 2.1.312 really was published earlier, on 27 October, to Open VSX and to npm. CellCog checked the three public lists and found them jumping from 2.1.312 to 2.1.314, with no 2.1.313 left behind, and 2.1.314 landing across those lists in about an hour on 30 October. So “I once installed 2.1.312” is not, by itself, a confession.
Cursor’s updated notice is about specific files that its store handed out during the Thursday window. It published these hashes for those marketplace builds:
| Cursor marketplace build | Machine | SHA-256 of the bad VSIX |
|---|---|---|
| 2.1.312 | Mac, Apple silicon (darwin-arm64) | fcbb327e38e61c4fec795e0d0591f52cd1014b813d20a5912104953c3a17c364 |
| 2.1.312 | Windows 64-bit (win32-x64) | 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 |
| 2.1.313 | Mac, Apple silicon | 80402fdcad8799285fd93044976973ca000da7995fb93363f819bb8e4f84ee6c |
| 2.1.313 | Windows 64-bit | 6786ec90cbd45949695bd7805c9fbb26cfc91bc5fc897de0183d9bcb9cb21731 |
A VSIX is the zip-like package an editor installs. The hash is of that package, not of your whole disk. You only need it if you still have the downloaded package and want to compare bytes. The svc-telemetry search is the test for “did it run on this computer.”
If the search finds the key
Treat that computer as touched, even if the tunnel step probably failed.
- Stop using it for email, GitHub, cloud consoles, or password managers. A later visit through a leftover key is the risk, not the extension icon.
- Disconnect it from the network if other people share your accounts from that machine. The attacker’s server is offline, which lowers the chance of a live session. It does not delete a key that is already written.
- From a different, trusted computer, rotate the secrets that this machine could see: GitHub and GitLab tokens, SSH keys you actually use, cloud keys, npm tokens, browser sessions. Cursor’s reason is blunt. Collecting the names of environment variables does not rule out a later login that reads the values.
- Remove the
svc-telemetryline, the LaunchAgent orSysMontask, and the.smtfiles. Cursor published scripts for this on its notice. Prefer those over a script you found in a reply on social media. Read them before you run them. - If the tunnel might have come up (you run as admin, or Remote Login was already on, or you see SSH logins you do not recognize), rebuild the machine. Cleaning files you know about does not prove there is no second change. Cursor tells you to look for SSH logins that came from the same computer, tied to that key.
I am not linking a random “cleaner” download. The primary page is Cursor’s notice: cursor.com/blog/claude-code-extension-security-notice.
If the search finds nothing
Cursor’s own check ends with “machine not impacted.” That is fair as a first cut, with three limits.
- It looks for one string in the key files. If you already replaced
authorized_keys, the string is gone and the test goes quiet. - It does not read old network logs. A beacon that fired and died leaves no line in that file.
- It does not cover a different computer. The laptop is not the desktop.
If you use the Claude Code extension inside Cursor, install a build Cursor currently serves, 2.1.314 or later, from the restored store. Do not “fix” this by downloading a VSIX from a blog.
If you only use Claude Code in the terminal, or only inside Microsoft’s VS Code, Anthropic’s public statement says you were not in this blast radius. The cheap svc-telemetry search is still reasonable. It costs nothing, and a clean result lets you stop rereading headlines.
What this is, and what it is not
This is a supply-chain incident (the product is tampered with on the road between the maker and you, not inside the maker’s model). The model did not get a secret instruction. The chat did not have to start. The editor loaded a plugin, and the plugin was not the plugin the publisher’s staff say they shipped.
It is not a reason to treat every Claude Code install as burnt. The terminal package and the Microsoft store are different roads, and the people who operate those roads say this package did not travel them.
It is not proof that Open VSX was poisoned. Anthropic says no. Socket could not find the version there. Other researchers say yes. Until someone shows the registry record, “Open VSX users must reinstall” is a stronger claim than the best evidence. “Cursor users from Thursday must run the key search” is not a strong claim. It is the claim the host of the file already made.
It is also not finished. The entry point into Cursor’s store is unpublished. A publisher name on a listing is not a lock. Auto-update (the editor fetching a new version without a ceremony) is how you get both the poison and the fix. The durable habit is smaller than “never update”: know which store you update from, and after a bad week, search for a new login you did not add. A coding plugin that plants an SSH key is not a style bug. It is the behavior worth noticing.
Common questions about the Claude Code extension backdoor
Was Anthropic hacked?
No. The poisoned copy lived in Cursor’s marketplace. Anthropic says its own download pages were clean.
Is uninstalling the extension enough?
No. A spare login file can remain. Search for it and rotate keys if you find one.
Which store was affected?
Cursor’s extension marketplace for the fake Claude Code add-on during the ~11-hour window on 29 October 2026.