Installed Claude Code in Cursor on Oct 29? Here's the 10-second backdoor check

If you use Cursor on a Mac or a Windows PC and Claude Code's extension installed or updated itself on Thursday, take 10 seconds and run one command.

What happened. Between about 2:27 a.m. and 1:35 p.m. PT on October 29, Cursor's VS Code extension marketplace served a maliciously modified build of Anthropic's Claude Code extension (Anthropic.claude-code). Cursor says the tampered versions were not made by Anthropic and reached at most 5,000 users. It pulled the build, shut the whole marketplace down, rotated its keys, rebuilt it and brought it back. It says it audited access and found no other tampered extensions.

What's new today. Cursor's first notice named version 2.1.313. Its update at 11:30 a.m. PT on October 30 says both 2.1.312 and 2.1.313, on macOS and Windows, were tampered with. If you dismissed this yesterday because you were "only on 2.1.312," check again.

What the payload does, per Cursor:

• Sends your hostname, username, OS, home folder, working folders, Git email, public IP and the names of environment variables to the attacker's server.
• Adds the attacker's SSH key, labeled svc-telemetry, to ~/.ssh/authorized_keys.
• Tries to turn on SSH and open a reverse tunnel, and installs a LaunchAgent (macOS) or a scheduled task (Windows) that retries about every 60 seconds.

The good news. Turning on the local SSH service needs admin rights the extension doesn't have on most Macs and PCs, so on those machines that step failed and the attacker couldn't log in through the tunnel. The attacker's server has also been taken offline. Cursor still says to follow its cleanup steps either way.

The 10-second check. This is Cursor's macOS command:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Cursor's notice has the PowerShell version for Windows, which also checks C:\ProgramData\ssh\administrators_authorized_keys.

Also look for leftovers. From Cursor's indicator list: ~/.config/.smt, ~/.config/.smtk, a .stk_ file in your temp folder, and on macOS ~/Library/LaunchAgents/com.apple.sysmond.plist. On Windows: a scheduled task named SysMon and a sysmon.cmd in your Startup folder. The modified extension.js contains the string svc-telemetry and the attacker's IP, 134.209.82.225.

If you find the key. Run Cursor's remediation script for your platform (linked in the notice), isolate the machine, and rotate every credential and session that machine could reach, from a different, trusted device. Uninstalling the extension may not be enough: the payload drops standalone scripts that keep running.

What we tested. We wrote a read-only shell check from Cursor's indicators (the key, the leftover files, the cron entry Cursor lists for Linux, and the payload strings in ~/.cursor/extensions) and ran it three ways on our Linux box: our real home folder (no indicators), an empty fake home folder (no indicators), and a fake home folder where we planted the key label, a .smt file and the IP string (it flagged all three). We never had the malicious extension, didn't run Cursor's remediation scripts, and didn't test on macOS or Windows.

Our take. Extensions run with your user's full access once your editor loads them. Turn off auto-update for extensions that touch your shell and keys, or at least know where your editor gets them from, and keep authorized_keys on your list of files to glance at after any supply-chain scare.