Backdoored Claude Code extension in Cursor (2.1.312 and 2.1.313)

Updated 2026-11-15

Short answer: you may be affected if you used the Claude Code extension in Cursor on 29 October 2026 and it installed or auto-updated to version 2.1.312 or 2.1.313. Cursor puts the window at about 2:27 a.m. to 1:35 p.m. PT and the count at most 5,000 users (The Hacker News). The clean version is 2.1.314. Updating does not remove what the bad version wrote outside the extension folder (Microsoft).

Who is not affected

The malicious versions were distributed only through Cursor's extension marketplace. Microsoft confirmed they were never in the Visual Studio Marketplace or in the npm package, Socket found no evidence they reached Open VSX, and Anthropic said its official channels were not affected (The Hacker News). Early reports that named Open VSX were corrected.

What the bad version does

• Adds an attacker key labelled svc-telemetry to ~/.ssh/authorized_keys.
• Tries to turn on the local SSH service and open a reverse SSH tunnel to 134.209.82[.]225.
• Installs persistence: a scheduled task on Windows, a crontab entry on Linux, a LaunchAgent on macOS.
• Sends host details to port 8099 at /beacon: public IP, hostname, user name, OS, home directory, Git email and the names (not values) of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP.

Turning on SSH needs admin rights, so on most macOS and Windows machines the tunnel step failed. The key, the persistence and the report still happen (Cursor, quoted by The Hacker News). Cursor later took the attacker's server offline so the reverse shell no longer works.

Check your machine (read-only)

1. In Cursor, open the Extensions view and read the installed Claude Code version.
2. Look for the planted key:

   grep -n svc-telemetry ~/.ssh/authorized_keys

   On Windows:

   findstr svc-telemetry %USERPROFILE%\.ssh\authorized_keys

3. Look for the tunnel address in startup entries:

   crontab -l 2>/dev/null | grep 134.209.82.225
   grep -rl 134.209.82.225 ~/Library/LaunchAgents 2>/dev/null

   On Windows, look in Task Scheduler for tasks you did not create.

If you find it

Microsoft and Cursor advise isolating the machine, removing the unauthorized SSH key and the persistence entries, then rotating credentials and revoking sessions. "Removing or updating the extension does not remove artifacts written outside its installation directory" (Microsoft).

FixLane pages for this incident: trojanized Claude Code extension on Cursor and backdoored Claude extension on the Cursor marketplace. A reviewed procedure for your system is served by the Telegram bot and the MCP server.

Questions

Which Claude Code extension versions were malicious?

anthropic.claude-code 2.1.312 and 2.1.313 distributed through the Cursor marketplace on 29 October 2026. 2.1.314 is the clean version.

Am I affected if I use Claude Code in VS Code?

Not by this incident. Microsoft confirmed the bad versions were never in the Visual Studio Marketplace or in the npm package, and Socket found no evidence they reached Open VSX.

Is updating to 2.1.314 enough?

No. The bad version writes an SSH key and startup entries outside the extension folder. Remove those, then rotate credentials and revoke sessions.

Sources

• The Hacker News: Claude Code extension on Cursor trojanized
• Ars Technica: Anthropic VS Code extension on Cursor backdoored

Check your own machine

Connect an AI agent to the free, read-only FixLane MCP server or ask the Telegram bot: it checks what you have installed against verified fixed versions and serves a reviewed fix procedure. All guides.