If you run Cursor with the Claude Code extension and it auto-updated on October 29, 2026, treat your workstation as compromised, not merely misconfigured. Version 2.1.314 removes the malicious code from the package, but according to the security advisories it does not undo what the bad build already installed.
What happened in those 11 hours
On October 29, an update carrying the Anthropic.claude-code identifier appeared on the Cursor Marketplace with a backdoor inside. It was available for roughly 11 hours, from 02:27 to 13:35 Pacific time (09:27–20:35 UTC), and researchers estimate that up to about 5,000 developer machines downloaded or auto-installed it. The macOS security firm Phorion was among the first to report it; Sophos, BleepingComputer and others followed with technical analysis.
The affected build is 2.1.313, with 2.1.312 also reported on some distribution channels. The clean replacement is 2.1.314.
The reported behavior is what makes this serious. The malicious code ran when the editor loaded the extension, before anyone opened a Claude chat. Reports describe it planting an SSH public key in ~/.ssh/authorized_keys, establishing persistence, and keeping an outbound tunnel that checked in roughly every 60 seconds with a command server at 134.209.82[.]225. That server has since been taken offline.
Why the update doesn't clean your machine
An extension update replaces files inside the extension folder. It knows nothing about a key written into your home directory or a launch agent registered with the operating system. Those artifacts live outside the extension's lifecycle, so uninstalling or upgrading only stops new infections.
That distinction shapes the response. A "we patched it" ticket closes the wrong problem. The real question is: what could this code reach while it ran? On a typical developer laptop, the answer is cloud CLI credentials, Git tokens, SSH private keys, LLM API keys, and the source code itself. The command server going dark reduces ongoing risk, but it does not revoke anything already collected or any key already authorized.
Host-level cleanup, in order
If the affected version touched a machine, work through these steps:
- Audit authorized SSH keys. Remove any public key you don't recognize, especially one labeled with an identifier like
svc-telemetry. - Remove persistence. Check
~/Library/LaunchAgents/on macOS,crontabon Linux, and Task Scheduler plus Startup folders on Windows. - Kill unexpected tunnels. Look for SSH or other processes making periodic outbound connections and terminate them.
- Rotate secrets. Assume anything readable by your user account was exposed: AWS/GCP/Azure credentials, GitHub/GitLab tokens, Anthropic or OpenAI API keys, and SSH private keys.
- Then update to 2.1.314 or remove the extension.
A quick first pass on macOS or Linux looks like this:
grep -n "svc-telemetry" ~/.ssh/authorized_keys
ls -lt ~/Library/LaunchAgents/ # macOS
crontab -l # Linux
An empty result is not proof of safety; it only rules out the most obvious indicators. Rotation is the step you should not skip.
The structural gap behind the incident
Two design facts turned one bad upload into thousands of compromised hosts.
First, VS Code-style extensions are not sandboxed. An extension's code runs in the editor's Node.js extension host with the same permissions as the user. Advisories describe the injected code as an immediately invoked function at the top of extension.js, which means it executed the moment the module loaded. There was no permission prompt to click through.
Second, AI-focused forks such as Cursor cannot use Microsoft's Visual Studio Marketplace, whose terms limit it to Microsoft products. They rely on Open VSX or their own registries. According to the reports, a weakness in how publisher namespace ownership was verified let an attacker ship an update under Anthropic's name. When the registry is the only gate, its identity checks are the whole security model.
Auto-update then did the distribution work: users received the build silently, with no signature warning.
This is not a reason to abandon AI editors. It is a reason to stop treating the extension list as personal preference and start treating it as software deployed to a machine that holds production credentials.
What teams should change now
- Pin extension versions and turn off silent updates on company machines. In VS Code-based editors, the
extensions.autoUpdatesetting controls this; roll updates out after a short delay instead of within minutes of publication. - Keep credentials off the host. Develop inside Dev Containers or remote environments so an extension sees a disposable workspace, not your SSH keys and cloud profiles.
- Prefer short-lived credentials, such as SSO-issued cloud sessions and fine-grained tokens with expiry, so a stolen secret ages out quickly.
- Inventory extensions across the team, the same way you inventory dependencies.
For Vietnamese teams adopting Cursor and Claude Code quickly to ship faster, the lesson is direct: the developer workstation is now a front-line target. The AI tool is valuable, but the machine running it is where your keys live, and that is what attackers wanted.
Loading comments…