Claude Code extension backdoor on Cursor: what small businesses should check now

A tampered copy of the Claude Code extension, the add-on that puts Anthropic's AI coding agent inside a code editor, was handed out through the Cursor editor's extension marketplace on October 29, 2026. Cursor says versions 2.1.312 and 2.1.313 for macOS and Windows were live from about 2:27 a.m. to 1:35 p.m. Pacific time and tried to install "a persistent SSH backdoor" (Cursor). That is roughly 5:27 a.m. to 4:35 p.m. in Toronto.

It became the most-discussed AI security story of the week. The first technical write-up reached 890 points and 528 comments on Hacker News, and our count of X posts mentioning Claude Code with words like backdoor, malicious or extension jumped from between 49 and 126 a day over the previous week to 3,868 on October 30 (UTC). "Claude code extension compromise" now appears in Google's autocomplete. Here is what happened, who should worry, and the five-minute check to run.

What happened to the Claude Code extension on Cursor

A normal-looking update with a hidden first step

Security firm Phorion found the problem. It says the attacker added a small block of code to the very start of the extension's main file and left the rest of the real extension untouched, so it still worked as expected. The added code runs as soon as the editor loads the file, before the extension even starts, and the user does not have to click anything (Phorion). Microsoft notes the extension kept working normally, so users had no reason to suspect anything (Microsoft).

What the hidden code tried to do

According to Cursor's notice, the code:

• collected the computer name, username, operating system, home folder, working folders, Git email, public IP address and the names of environment variables;
• added an attacker's SSH key, labelled `svc-telemetry`, to the user's authorized keys, tried to switch on remote login and opened a reverse tunnel to the attacker's server;
• set itself to start again after a reboot, using a LaunchAgent on macOS or a scheduled task or Startup script on Windows, retrying about every 60 seconds (Cursor).

Phorion notes it only sent the names of variables that look like keys, tokens or passwords, not their values (Phorion). BleepingComputer reads this as a sign the attackers planned to collect credentials by hand once the tunnel was open (BleepingComputer).

Why most machines were not opened up

Cursor says switching on the computer's SSH service needs administrator rights the extension does not have on most Mac and Windows machines, so "the attacker could not have logged in through the tunnel" on those machines. It also says it worked with the hosting company to take the attacker's server offline (Cursor). Phorion traced the Mac failure to a bug: the code could not read the remote-login setting without admin rights, so it skipped the step that turns it on (Phorion). BleepingComputer reports a separate bug blocked the Windows step (BleepingComputer).

That is luck, not protection. Cursor says the extension still added the key, installed its restart script and sent machine details, and asks everyone affected to follow the clean-up steps "regardless" (Cursor).

Who is affected and who is not

Only Cursor's marketplace

Microsoft says it confirmed the tampered packages were never published on its Visual Studio Marketplace or on npm, and that Anthropic told Microsoft its systems were not compromised (Microsoft). Socket found no record of version 2.1.313 being published on Open VSX either (Socket). Anthropic's Felix Rieseberg wrote that "a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish," as quoted by The Register.

Up to 5,000 developers

BleepingComputer reports the package exposed up to 5,000 developers, and Sophos says that estimate comes from Cursor (BleepingComputer, Sophos). Cursor says it removed the versions, shut down the whole marketplace, checked that no other extensions were tampered with, changed its keys and rebuilt the marketplace before bringing it back (Cursor).

How to check a computer in one minute

Cursor's notice gives a one-line check. On a Mac, open Terminal and run:

`grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"`

Windows users get a short PowerShell version on the same page (Cursor). If the key is found, Cursor says to isolate the machine, run its clean-up script, consider rebuilding the machine and change any passwords and tokens that machine could reach, from a different, trusted computer. Uninstalling or updating the extension "may not be sufficient" because the restart scripts live outside it (Cursor).

What we did not verify

We did not install the tampered package or run Cursor's scripts. Cursor's notice, as we read it, does not itself state the 5,000 figure; we rely on BleepingComputer and Sophos for it. Neither Cursor nor Anthropic has explained how the attacker got access to publish under Anthropic's name, according to The Register.

What this means for small businesses

You may never open a code editor, but the freelancer who edits your website, your IDX listings plugin or your booking system may use Cursor every day. Their laptop holds your hosting logins, payment keys and customer data.

1. Ask today. Send anyone who builds or maintains your site the Cursor check above and ask for a reply either way. Log the answer with our incident summary writer.
2. Change shared logins if in doubt. If a contractor's machine was affected, rotate the website, hosting, CRM and payment keys they could reach. Our access provisioning checklist helps you list them.
3. Give agents and contractors their own accounts. Decide which accounts an AI agent may log into, so one bad laptop does not expose everything. See also our story on shadow AI and Claude Code.
4. Slow down new extension updates. Microsoft suggests limiting Cursor extensions to approved publishers and adding a waiting period before newly published versions install (Microsoft). Keep the computer your agents run on patched.
5. Do a personal checkup. Run the 15-minute security checkup prompt, tighten any written agent rules with the prompt grader, and weigh the time AI coding tools save against the risk with the AI time savings calculator.

Frequently asked questions

Is Claude Code safe to use?

Anthropic says its official versions were not affected and only Cursor users who got the tampered copy were impacted (The Register). Microsoft confirmed the bad packages were never on the VS Code Marketplace or npm (Microsoft).

Which Claude Code extension versions were malicious?

Versions 2.1.312 and 2.1.313 for macOS and Windows, installed or updated from Cursor's marketplace between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026 (Cursor).

How do I know if my computer was affected?

Look for an SSH key labelled `svc-telemetry` in your authorized keys file using the command in Cursor's notice. If it is there, the machine is affected (Cursor).

Does uninstalling the extension remove the backdoor?

No. Cursor and Phorion both say the restart scripts and the planted key stay behind, so you must remove them separately or run Cursor's clean-up script (Cursor, Phorion).

Were passwords stolen?

The code sent the names of environment variables, not their values, according to Phorion and BleepingComputer. Cursor warns that this "does not rule out later credential access over the backdoor", so change logins on affected machines (Cursor).

Sources

• Cursor: Security notice on malicious Anthropic.claude-code 2.1.312 and 2.1.313
• Phorion: Official Claude Code Extension Compromise, security advisory
• Microsoft Security Blog: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
• BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors
• The Register: Anthropic says the Claude Code extension compromise was not its systems
• Sophos: Malicious Claude Code extension distributed through Cursor marketplace
• Socket: Cursor removes malicious Claude Code 2.1.313 extension
• Hacker News: Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

How we report: every fact, number and quote above comes from the linked sources, which we read before publishing. Product details can change quickly during previews, so check the vendor page before you buy. Spotted an error? Tell us via the link on our home page.