Cursor identified two maliciously modified versions of the Claude Code extension on its extension marketplace, removed them, and blocked distribution. Users who installed or updated to them on macOS or Windows should check remote access keys and malicious files. They should also rotate credentials and replace sessions accessible from affected devices.

1. When and where the malicious versions were distributed

According to Cursor, the malicious versions were available on the Cursor VS Code extension marketplace on October 29, 2026, from about 2:27 a.m. to 1:35 p.m. US Pacific time. They were versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension, but were not developed by Anthropic. Affected users are those on macOS or Windows who installed or updated to either version from the marketplace during that period.

The malware collected and transmitted the hostname, username, operating system, architecture (processor architecture), and home directory path. It also collected environment variable names (names that identify information about the program's execution environment). The malware also collected the working directory, the configured Git email, and the public IP (an address identifying the device on the internet).

2. Keys and persistence left behind by remote access attempts

The malware added an attacker SSH key, a cryptographic key used for remote access authentication, to the authorized access list. It then attempted to enable the local SSH service and open a reverse SSH tunnel. This connects the device to an attacker server first, creating a route for external access back into the device.

Cursor said SSH service activation failed on most macOS and Windows hosts without administrator privileges, preventing logins through the tunnel. It also said it worked with the hosting provider to shut down the attacker server, disabling remote command execution and host information transmission.

However, according to the company, attacker keys were added, malware persistence mechanisms were installed, and host information was transmitted. On macOS, the malware installed a LaunchAgent, a configuration registered to restart execution at login. On Windows, it installed a scheduled task, a job set to run automatically under specified conditions, that attempted to run with system privileges. It also left a startup folder script on Windows as a fallback, and the background script was designed to retry the tunnel connection about every 60 seconds.

3. Marketplace blocking and rebuilding

After removing the malicious versions and blocking further distribution, Cursor temporarily suspended the entire marketplace as a precaution. It audited access logs and confirmed that other extensions had not been modified, then rotated keys, rebuilt the marketplace, and reopened it. This response prevented further distribution of the malicious extensions at the cost of suspending the entire marketplace during inspection and rebuilding.

4. Check keys and clean up infected hosts

Cursor advised checking for infection by looking for the marker svc-telemetry in the SSH authorized keys file. On macOS, run the following command in Terminal.

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

If the marker is found, the device is infected, and the key, persistence mechanisms, and running tunnel processes must be removed along with the malicious extension. Cursor's OS-specific cleanup scripts return a nonzero exit status, a value indicating a program's execution result, if any items remain. Cursor advised running them as the affected user on macOS and in an administrator PowerShell session on Windows.

Organizations should search endpoints, meaning user devices connected to the network, as well as networks and extension installation records for indicators of compromise. These indicators are traces used to determine whether a compromise occurred. Hosts showing signs of payload execution, meaning code that performs malicious actions, or backdoor installation, meaning a hidden route for reentry, should be isolated and assessed for rebuilding. Credentials, meaning information used to verify accounts and access, and sessions, meaning connections that retain login state, accessible from those hosts should be rotated or replaced from a trusted system. This response includes cleaning up scripts that run independently of the extension.

Resolving this incident requires blocking marketplace distribution, removing keys and persistence mechanisms from infected devices, and rotating credentials together.