Claude Code extension on Cursor hacked? How to check your machine

Only one build was poisoned, and only in one store. The tampered package was the 2.1 release labeled build three-thirteen, served through Cursor’s VS Code extension marketplace between roughly 2:27 a.m. and 1:35 p.m. Pacific time on October 29.

• Affected: people who installed or auto-updated Claude Code inside Cursor during that window.
• Not known to be affected: people who got Claude Code from Microsoft’s Visual Studio Marketplace or from Open VSX, the open-source store used by many VS Code-style editors.
• The fix: Anthropic has published a clean follow-up build, three-fourteen, to both Microsoft’s store and Open VSX.

Early reports blamed Open VSX. Researchers later traced the bad listing to Cursor’s own marketplace, and one security researcher publicly disputed the Open VSX claim. Cursor stresses that Anthropic didn’t write the malicious code, and it says no other extensions in its store were tampered with.

How to see which version you have

Open the Extensions panel in Cursor, click Claude Code and read the version shown next to its name. If it says 2.1 with three-thirteen at the end, or you aren’t sure what you ran on October 29, treat the machine as possibly affected and do the check below.

The attack hid in plain sight. Jenn Gile, co-founder of the research group OpenSourceMalware, says a 66-line loader was stuck on the front of the normal extension code. Calum Hall, chief executive of the macOS security firm Phorion, says it fired the moment the editor loaded the file, before the extension even started, so you didn’t need to open Claude Code for it to run.

Once running, it did four things:

1. Planted a key. It added the attacker’s SSH key to your authorized keys file, giving it the innocent-sounding label svc-telemetry. SSH is the standard tool for logging in to a computer remotely, and that file is the list of keys allowed in without a password.
2. Opened a back door. It tried to switch on the computer’s SSH service and dug an outbound tunnel to the attacker’s server, retrying about every 60 seconds even after the editor was closed.
3. Made itself stick. On a Mac it installed a startup file named to look like an Apple service, on Linux a cron job that runs at boot, and on Windows a scheduled task called SysMon with a Startup-folder backup.
4. Phoned home. It sent your username, computer name, operating system, chip type, folders, public IP address and the email in your Git settings to the attacker over plain, unencrypted web traffic.

It also sent the names, but not the contents, of up to 40 environment variables that looked like secrets, such as anything containing KEY, TOKEN, PASS, AWS or GCP. Paul McCarty, a security researcher, points out that even the names act like a map: they tell an attacker which machines hold cloud logins worth coming back for.

The back door only works if the SSH service is running, and switching that on needs administrator rights. Cursor says the extension doesn’t have those rights on most Mac and Windows machines, so on those computers the attacker couldn’t actually log in through the tunnel. Phorion found a buggy check in the Mac code that made it skip the step entirely.

That is not a free pass. Hall warns that a Mac with Remote Login already on, or one where you turn it on later, is ready for the attacker to use. Linux machines and developer boxes that already run SSH are the riskiest. And on every system the planted key, the startup scripts and the data report still happened.

Cursor also worked with the hosting company behind the attacker’s server to take it down, which means the tunnel and the data reports no longer reach anyone. Leftover files can still be reused, though, so clean them up.

For most people using Claude Code through Microsoft’s marketplace, nothing changes today. For Cursor users, this is a reminder that an extension update runs with the same access you have: your files, your Git account and any keys stored on the machine.

The bigger lesson is about auto-updates. Gile notes that anyone whose copy was set to auto-update could have installed the malware without noticing. Ax Sharma of Manifold Security makes the same point: more and more software is now installed by agents and automatic updaters, not by a person reading a listing. A little over a week earlier, an attacker swapped the downloadable files of several published versions of OVHcloud’s command-line tool for a secret-stealing program, so this isn’t a one-off.

Uninstalling the extension won’t remove the back door, because the payload leaves separate scripts that keep running. Follow these steps instead:

1. Look for the key. On a Mac or Linux machine, open Terminal and search your authorized keys file (in the .ssh folder in your home folder) for the text svc-telemetry. On Windows, Cursor’s PowerShell check also looks in the administrators keys file under ProgramData\ssh.
2. If it’s there, run Cursor’s cleanup script. Cursor has published one for each platform. Run the Mac script as your normal user, not as root, and run the Windows script from PowerShell opened as administrator. Both remove the extension, the startup items, the tunnel and the key, and report an error if anything is left.
3. Update Claude Code. Install the clean build three-fourteen or later.
4. Rotate your secrets from a different, trusted computer. Change cloud keys, API tokens, Git and SSH credentials, and sign out of sessions that machine could reach.
5. Check for a visit. Phorion suggests looking in your SSH logs for logins from the local machine that used the svc-telemetry key.
6. Consider a rebuild. Cursor says isolating the machine and reinstalling it is the safest option if you find signs the payload ran.

If you’d rather review updates yourself, turn off automatic extension updates in Cursor’s settings and update after reading the changelog.