A Poisoned Claude Code Update Hit Up to 5,000 Cursor Users

A poisoned Claude Code update reached up to 5,000 Cursor users on October 29, 2026, Cursor says. It adds an attacker's SSH key to your machine, and uninstalling the extension may not remove what it left behind. Here's what happened, the one-line check, and what to do if you're affected.

What happened

Between about 2:27 am and 1:35 pm Pacific on October 29, a maliciously modified version of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313 for Mac and Windows, was available in the Cursor VS Code Extension Marketplace. That's according to Cursor's security notice, which says these versions "were not developed by Anthropic." On X, Cursor said the incident impacted "at most 5,000 users."

The security firm Phorion published a technical advisory on October 30 (UTC). It found that the injected code runs as soon as the extension file loads, before the extension's normal startup, so "the user doesn't need to interact with the extension for the payload to fire."

Cursor says it removed the bad versions, shut its whole marketplace down as a precaution, audited access and found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back. It also worked with the hosting provider to take the attacker's server offline. Cursor says it has no evidence that other versions of the extension or the official distribution were affected.

What the extension does

Per Cursor's notice and Phorion's write-up, the payload:

• Sends host details to the attacker: hostname, username, OS, home directory, environment variable names (not values), working directories, your configured Git email and public IP.
• Adds an attacker-controlled SSH key to ~/.ssh/authorized_keys, labelled svc-telemetry.
• Tries to turn on SSH and open a reverse SSH tunnel to the attacker's server.
• Installs persistence: a LaunchAgent on macOS, a scheduled task named SysMon (with a Startup-folder fallback) on Windows. Background scripts retry the tunnel roughly every 60 seconds, even after you close the editor.

The good news: turning on SSH needs admin rights, which the extension doesn't have on most Macs and Windows PCs. Cursor says that on those machines "the attacker could not have logged in through the tunnel." Phorion also found a bug in the macOS code that skips the step entirely for normal users. The key and the persistence are still there, though, and the host details were already sent. Phorion notes that if Remote Login was already on, or gets turned on later, the planted key could still let someone in. That's why you remove it.

Check your machine

1. On a Mac, run Cursor's check: grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted". Cursor's notice has the PowerShell version for Windows.
2. Phorion points out the malware checks for the label rather than the key itself, so also compare every key in authorized_keys against the "unauthorized key fingerprint" in Cursor's indicators of compromise (SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk), not just the one labelled svc-telemetry.
3. Update Claude Code for VS Code to 2.1.314, the version Cursor asks everyone to move to.
4. If the key is there, don't just uninstall. Cursor says to isolate the machine, run its remediation script (macOS or Windows), remove the key, the persistence and any running tunnel processes, consider a rebuild, and rotate the credentials and sessions that machine could reach, from a trusted computer.

Here's how you get paid

My opinion: in my experience, many small dev teams let every developer install any editor extension, and extensions usually update on their own. Few people have ever looked at what's in their authorized_keys file. This incident gives you a concrete reason to start that conversation.

Sell an extension lockdown to small dev teams and agencies:

• Approved list. Inventory the extensions everyone actually uses and agree on the list. In VS Code 1.96 and later, the extensions.allowed setting can allow or block extensions by publisher, extension ID, version and platform, and admins can enforce it on managed devices through the AllowedExtensions policy. Check what the team's editor supports before you promise it.
• Pinned versions. VS Code's docs show how to pin an extension to one or more approved versions, and a blocked version that's already installed gets disabled. Only version numbers you approved run (pinning doesn't verify where a package came from, so keep the key check too).
• Weekly key check. A small scheduled script that flags SSH keys nobody added and new startup items, plus a one-page "what to do" for when it fires.

No income guaranteed. Price it as a fixed setup fee plus a small monthly check-in.