Claude Code VS Code Extension 2.1.313 Compromised: SSH Backdoor, Up to 5,000 Users, How to Check and Clean Up

Cursor says a modified build of the Claude Code VS Code extension, Anthropic.claude-code version 2.1.313, was served from its extension marketplace on October 29, 2026 and affected at most 5,000 users. It was not developed by Anthropic. The loader tries to add an attacker SSH key labeled svc-telemetry to your authorized_keys, installs persistence, and sends host details to a server. Cursor asks customers to move to Claude Code for VS Code 2.1.314.

If you installed or updated the extension on Cursor during October 29, check now: it takes one command. This post gives the check, the indicators, the cleanup order and what is still unknown. Statements come from Cursor's security notice unless stated otherwise.

TL;DR

What Cursor said

Cursor's post on X, October 30, says it identified a security incident affecting a modified Claude Code VS Code extension accessed through its extension marketplace, impacting at most 5,000 users. It says the extension does not affect other extensions on its marketplace, its Grok products or its other products. In response it took the marketplace down, worked with providers to neutralize the malware and reinstated the marketplace after confirming there was no further risk.

The longer notice on the Cursor blog adds:

• The version was removed on detection and further distribution was blocked.
• Cursor shut down the VS Code marketplace as a precaution, rotated its keys, rebuilt it and brought it back.
• Working with the hosting provider, Cursor took the attacker server offline. It says the server no longer functions.
• Cursor has no evidence other extension versions or the official distribution are affected.
• Contact for questions: [email protected].

What the malicious extension does

Researchers quoted by The Hacker News describe a 66-line loader inserted into the main JavaScript bundle, ahead of the real code. It runs after VS Code starts and when the extension's webview opens. Cursor's notice describes these actions:

1. Profiles the host. Hostname, username, OS, architecture, home and working directories, global git email, public IP, and the names (not values) of environment variables. The Hacker News says up to 40 names matching terms like KEY, TOKEN or SECRET.
2. Plants an SSH backdoor. It tries to add the attacker's key to authorized_keys, enable the local SSH service, and open a reverse SSH tunnel to the attacker server.
3. Persists. A LaunchAgent on macOS, or a scheduled task with a Startup-script fallback on Windows. Background scripts retry the tunnel about every 60 seconds. The Hacker News adds a crontab entry for Linux; Cursor's indicators do not cover that, so treat it as researcher-reported.
4. Reports back. It POSTs host details and the backdoor's status over plain HTTP to port 8099 at /beacon.

An important detail from Cursor: enabling the local SSH service normally needs admin rights, which the extension usually lacks on macOS and Windows. So the tunnel likely would not give the attacker a login on those machines. But the key addition, the persistence and the reporting can still happen, which is why Cursor says to remediate regardless. No follow-on payloads have been reported.

Step 1: check whether you are affected

Cursor's own check looks for the planted key.

macOS:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Windows (PowerShell):

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

If the key is found, treat the machine as impacted. Also look for the extension folder anthropic.claude-code-2.1.313-darwin-arm64 or -win32-x64 in your Cursor extensions directory. On Linux, which Cursor's notice does not cover, run the same grep and also check crontab -l for an @reboot entry pointing at ~/.config/.smt.

Indicators of compromise (from Cursor's notice)

Public IP lookups to ifconfig.me and api.ipify.org are legitimate services; seeing them alone is not an indicator. The com.apple.sysmond name imitates Apple but is not an Apple component. Cursor also lists SHA-256 hashes of the modified VSIX files in its notice; use those from the source rather than from third-party summaries, as hashes differ between write-ups we saw.

Step 2: clean up, in this order

Cursor warns that uninstalling the extension may not be enough, because the payload drops persistence that outlives it.

1. Isolate any host with the key, the persistence files or the beacon traffic.
2. Remove the unauthorized key, the persistence and the tunnel processes. Cursor publishes remediation scripts on its notice page: remediate-macos.sh (run as the affected user, not root) and remediate-windows.ps1 (run from an elevated PowerShell). They remove the extension, persistence, tunnel processes and the key, and exit non-zero if anything remains. Download them from Cursor's page, read them, and run them from there only.
3. Decide whether to rebuild. If the machine is a developer laptop with access to production, rebuilding is the safer choice.
4. Rotate credentials and sessions reachable from the host, using a trusted machine. Priorities: SSH keys and cloud CLI sessions, git and package-registry tokens, API keys in .env files and shell profiles, and AI provider keys. The malware collected only variable names, but Cursor notes that does not rule out later access over the backdoor, and names show an attacker which services you use.
5. Search your telemetry for the IOCs above: EDR, DNS and proxy logs for the IP and port 8099, and extension-install events for 2.1.313.
6. Then update Claude Code for VS Code to 2.1.314 from a clean state, and turn off auto-update for extensions on sensitive machines until you have reviewed releases.

For a general runbook, see your first 24 hours after a vendor breach.

What we know and what we do not

Anthropic has not published its own statement in the sources we checked. Anthropic's changelog is reported to skip from 2.1.312 to 2.1.314, which suggests Anthropic did not publish 2.1.313, but that is an observation by a third party and not an official confirmation.

Update (October 30, 2026): Phorion's analysis of the loader

Endpoint-security firm Phorion published a reverse-engineering write-up of the backdoored extension.js. It adds detail that changes what to hunt for. Phorion also reports that Cursor pulled the 2.1.313 release from its marketplace and that the NPM and VS Code registry versions were pulled too; we have not confirmed the registry removals independently.

• Why SSH often does not open on macOS. The loader runs systemsetup -getremotelogin without elevation. As a standard user that prints "You need administrator access..." and exits 0, so the check for "Off" never matches and the sudo -n ... -setremotelogin on step is skipped. If Remote Login is off, the tunnel connects out but forwards to a closed port 22. Phorion stresses this is not a defence: if Remote Login is already on, or you turn it on later, the planted key works. The Windows path has its own bug (it routes a PowerShell command through /bin/sh).
• How the access works. The key comment svc-telemetry is the attacker's login key; a second key, svc-telemetry-tun, lets your machine connect out to the tunnel server with -R *:0:localhost:22, so the server allocates a port and forwards back to your local SSH. Because sessions arrive through the forward, successful attacker logins show in your SSH logs as coming from 127.0.0.1 or ::1, authenticating with the svc-telemetry key.
• Hunt by fingerprint, not just comment. The script only checks whether the string svc-telemetry is already present, so match the key fingerprints listed above.
• Cron risk on Linux. Phorion says the crontab check in the Linux persistence step can wipe existing user cron jobs (its page gives no further detail). Back up crontab -l before cleaning up.
• Detection signals. The key is appended with Node's fs.appendFileSync, so rules that only watch shell commands such as echo or tee miss it. Watch for editor helper processes (Code Helper, Cursor Helper) writing ~/.ssh/authorized_keys, a non-Apple process writing a com.apple.* LaunchAgent, and a LaunchAgent running /bin/sh on a hidden script in the home directory. The tunnel is detached, so ssh will not show the editor as its parent.
• Extra artifacts. Phorion lists the SHA-256 of the backdoored bundle (ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15) and says the recon beacon sends only environment variable names matching KEY|TOKEN|SECRET|PASS|AWS|GCP (up to 40), not values, which matches the account above. Its remediation order: kill the tunnel processes, remove persistence and ~/.config/.smt and .smtk, delete /tmp/.stk_* and the planted key, then rotate credentials if SSH was enabled or any inbound login is seen.

Phorion sells endpoint security; we cite its technical findings, not its product claims.

Update (October 30, 2026): Socket finds no public 2.1.313 on Open VSX or npm

Socket's research team checked the public registries and found no evidence that 2.1.313 was ever published to Open VSX or npm. This narrows where the malicious build could have come from, and it supports Cursor's account that the distribution path was its own marketplace.

• Open VSX. Socket reviewed 3,392 events in the registry's append-only change feed, from October 27 to October 30 at 05:35 UTC. It shows ACTIVE events for all eight platform builds of 2.1.312 and of 2.1.314, and none for 2.1.313. In the same window, 42 versions across 21 other extensions were published and then removed, and each kept both events, one of them removed after about 90 seconds.
• npm. Version 2.1.313 of @anthropic-ai/claude-code is absent from both the versions object and the time map, which normally keeps timestamps even for unpublished versions. The neighbours are 2.1.312 (October 27, 18:36 UTC) and 2.1.314 (October 30, 00:12 UTC). Socket notes that this is not an absolute guarantee that no attempted publication happened.
• The early screenshot. The image shared with the first report showed 2.1.313 as the latest Open VSX release, but its Linux and Windows download sizes (135.13 MB and 136.07 MB) match the public 2.1.314 builds. Socket says this does not prove manipulation, since Open VSX rounds sizes, and the sample analysed was a macOS build. The screenshot has since been removed, and the original OpenSourceMalware article was revised so it no longer names Open VSX.
• A skipped number is not proof. Socket points out that other versions between 2.1.260 and 2.1.314 are also missing from the catalogs, so the gap alone proves nothing.

For exposure checks, the question is whether the extension was installed or updated through Cursor's marketplace on October 29, not whether you used Open VSX or npm. Cursor's notice supplies the hashes, indicators and remediation scripts; use those, as described above. How the build entered the Cursor marketplace is still unexplained.

Update (October 30, 2026): Kevin Beaumont's analysis, hunting queries and publisher-account question

Security researcher Kevin Beaumont published an analysis on DoublePulsar that adds points the earlier sources left open. These are his statements; we have not independently confirmed them.

• Publisher account. Beaumont argues Cursor's wording that the build "was not developed by Anthropic" is carefully chosen, and says the malicious version was uploaded under Anthropic's verified publisher account. If true, "check that the publisher is Anthropic" would not have caught it. Cursor's notice does not say how the package got into the marketplace, and that remains unexplained.
• Disclosure. He says Anthropic has not informed customers and that the backdoored version was removed without announcement. We found no Anthropic statement in the sources we checked, which matches that.
• Scale. He describes the extension as used by tens of millions of developers. Cursor's figure for affected systems is at most 5,000, and he repeats it. Treat the user-base number as his estimate, not a measured figure.
• Hunting. He published Microsoft Defender for Endpoint KQL queries for the incident in his ThreatHunting repository (AnthropicSupplyChainAttack.kql). Read them before running, and adapt for other EDR tools.
• Hashes. He lists the modified VSIX SHA-256 values: 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62 (darwin-arm64) and 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 (win32-x64). Earlier in this post we noted that hashes differ between write-ups; compare against Cursor's notice first.
• Version 2.1.314. He says it appears to remove the backdoor from the extension but he cannot rule out other malicious code, and that it does not remove an SSH backdoor already planted, nor undo the recon data already sent. That is consistent with the cleanup order above: remove the key and persistence first, then update.

The network indicators he lists match Cursor's (134[.]209[.]82[.]225 on port 22 for the tunnel, :8099/beacon for the HTTP POST).

Update (October 30, 2026): Anthropic says its systems were not compromised

The Register reports that Anthropic has now responded publicly, in a post on X by Felix Rieseberg, a member of its technical staff. According to the report, he wrote that Anthropic is working with Cursor on the incident, but that "it wasn't a compromise of Anthropic's systems or employee laptops." His statement says a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension that Anthropic "didn't build or publish," that the versions on Anthropic's official channels are not affected, and that the issue only affects Cursor users.

What this changes, and what it does not:

• It supports the earlier reading. Cursor's notice, Socket's registry check and the missing 2.1.313 in Anthropic's changelog all pointed to the Cursor marketplace as the distribution path. Anthropic now says the same, so the exposure question stays "did your Cursor install or update the extension on October 29?" and not "did you use Anthropic's channels?"
• It does not answer how. The Register notes that neither company has said how the tampered package reached the marketplace. Kevin Beaumont's claim above that it went out under Anthropic's verified publisher account is still unconfirmed by either vendor, and Anthropic's wording ("didn't build or publish") does not address it.
• Cleanup is unchanged. The Register repeats Cursor's point that installing the latest version is not enough to remove persistence, and that the SSH key and persistence mechanism are dropped even where the tunnel fails. Follow the cleanup order in Step 2 and Cursor's scripts.
• Cursor's own response. Per Cursor's advisory as quoted by The Register, it removed the malicious version on detection, shut down the VS Code marketplace as a precaution, checked that no other extensions were compromised the same way, rotated its own keys before restoring the marketplace, and worked with a cloud hosting provider to block the attacker's server.

The earlier note above that Anthropic had not published its own statement is superseded by this update. We have only seen the statement second-hand through The Register.

Why this matters for AI coding agent users

An IDE extension runs with your user's permissions and starts with the editor. That makes a trojanized agent extension valuable: the same machine usually holds SSH keys, cloud credentials, .env files and the agent's own tokens. The attack also borrowed trust twice, from Anthropic's name and from a marketplace.

It fits this month's pattern of attacks on developer tooling: the OVHcloud CLI release binary swap (which The Hacker News links to the GlassWorm operation), the Zeabur environment variable breach and the Polymarket vendor script compromise. Our October software supply chain tracker lists the rest.

Practical hardening for teams:

• Pin extension versions on machines with production access and review updates before rolling them out.
• Prefer an allowlist of publishers and extension IDs through your IDE management settings.
• Keep SSH authorized_keys monitored; a new key you did not add is a high-signal alert.
• Alert on new LaunchAgents, scheduled tasks and autossh processes started from a user's editor.

How Beam handles this

Beam is a local-first monitor for AI coding agents. It is not an extension scanner and would not have blocked the install of 2.1.313. What it can do on a machine you suspect is exposed is show what your agents have read and run, such as .env files and credential paths, and flag unexpected commands, so you know what to rotate first. It does not remove malware; use Cursor's remediation scripts and your endpoint tools for that.

Related reading

• OVHcloud CLI release binaries swapped for an infostealer
• Polymarket third-party script compromise
• Zeabur second breach and shutdown: rotate every secret
• October 2026 software supply chain incidents tracker
• Your first 24 hours after a vendor breach: a rotation and monitoring runbook
• October 2026 attacks timeline

Primary sources: Cursor security notice · Cursor on X · Reporting: The Hacker News · Rescana · The Hacker News on X

Accurate as of October 30, 2026. This is a developing incident; the entry point, attribution and the safe version should be confirmed against Cursor's notice and Anthropic.