Malicious Claude Code extension hit Cursor's marketplace: check your Mac or PC

If you use Cursor on a home Mac or Windows PC, and you installed or updated the Claude Code extension from Cursor’s own marketplace on October 29, 2026, check one thing: whether an SSH key labeled svc-telemetry was added to your machine. Cursor published a security notice the same day. Cursor updated it on October 30, and Microsoft Threat Intelligence published a detailed analysis the same day.

This is a personal-computer story. People run Cursor on laptops that also hold password managers, browser sessions, and side projects. A poisoned add-on that tries to open remote access to your computer puts all of that at risk.

What happened

Cursor says that between about 2:27 a.m. PT and 1:35 p.m. PT on October 29, 2026, maliciously modified builds of Anthropic.claude-code versions 2.1.312 and 2.1.313 (Windows and macOS) were available in the Cursor VS Code Extension Marketplace. Cursor states those builds were not developed by Anthropic.

According to Cursor’s notice, the malicious extension tried to:

• Collect computer details (hostname, username, OS, architecture, home folder, environment variable names, working folders, Git email, public IP) and send them to the attacker. Microsoft says it sent the names of variables that look like passwords or keys, not their values
• Add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel
• Persist that tunnel with a macOS LaunchAgent or a Windows scheduled task / Startup-script fallback, retrying roughly every 60 seconds

Cursor says turning on the local SSH service needs administrator rights, which the extension did not have on most Macs and Windows PCs, and that errors in the malicious code also made that step fail outside unusual cases. On those computers the attacker could not log in through the tunnel. That is luck, not a clean bill of health: Cursor says the extension still added the attacker’s key, set itself up to keep running, and sent computer details. Cursor removed the bad versions, briefly shut down its marketplace, rebuilt it, and worked with the hosting provider to take the attacker’s server offline.

Microsoft says the bad packages were never published on the Visual Studio Marketplace or Anthropic’s official npm package, and that all evidence points to Cursor’s marketplace alone. Anthropic said publicly, and confirmed to Microsoft, that its systems were not compromised and that it did not build the tampered copy.

WIRED reported Cursor’s estimate that the bad versions were downloaded by “at most 5,000 users” (CSO Online also covered the incident). That is Cursor’s estimate, so check anyway if you might have been one of them.

Who needs to act

Act if all of this is true:

• You use Cursor on macOS or Windows
• You installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace during that October 29 Pacific Time window

You are not affected, according to Cursor, if you never installed that extension, only use other Cursor extensions, or got Claude Code only from Anthropic’s official channels. Still, the check takes a minute, so run it if you updated extensions that day.

How to check on your own computer

Cursor’s notice gives a simple check for each system. Run it as your normal user.

macOS (Terminal):

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Windows (PowerShell):

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

If the key is found, Cursor says the computer is affected. Uninstalling the extension may not be enough, because the malware leaves behind separate scripts that keep running.

How to clean up if you are impacted

1. Download Cursor’s cleanup script from the security notice for your platform (remediate-macos.sh or remediate-windows.ps1).
2. On macOS, run the script as your user (not root) from the folder where you saved it: bash remediate-macos.sh
3. On Windows, open PowerShell as Administrator in that folder and run: powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1
4. Until cleanup finishes, do not sign in to sensitive accounts on that computer.
5. From a different, trusted computer, change passwords, replace SSH keys, and sign out of sessions that the affected computer could reach.
6. Run the svc-telemetry check again. Cursor’s scripts report an error if anything remains. Also look for the leftover items Cursor listed (for example macOS com.apple.sysmond LaunchAgent, Windows scheduled task SysMon, and the .smt / .smtk style files in the notice).

If anything still looks wrong after the script, erase and reinstall the computer. Cursor’s notice says to consider that for affected computers.

What stayed safe (per the vendors)

• Cursor says other extensions in its marketplace were not tampered with, after an audit.
• Microsoft says the malicious packages were not published on the Visual Studio Marketplace or on Anthropic’s official npm Claude Code distribution.
• Anthropic says its official channels were not the source of the bad builds.

That does not mean “extensions are harmless.” It means this incident had a specific marketplace window and specific version numbers. Keep automatic updates on, but pay attention when a tool you use posts a security notice.

Do this / don’t do that

Do

• Run the svc-telemetry check if you touched Claude Code in Cursor on October 29.
• Use Cursor’s official cleanup scripts if the key is present.
• Change passwords and keys from a clean device if your computer was affected.

Don’t

• Do not assume uninstalling the extension removed everything.
• Do not ignore the notice because the attacker server is offline. The attacker’s key and leftover scripts are still on affected computers until you remove them.
• Do not paste random “cleanup” scripts from social media. Use Cursor’s notice.
• Do not confuse this with a break-in at Anthropic. The companies say it was a tampered copy in Cursor’s marketplace.

Bottom line

On October 29, 2026, malicious Anthropic.claude-code 2.1.312 / 2.1.313 builds briefly appeared in Cursor’s marketplace and tried to plant a persistent SSH backdoor (Cursor notice, Microsoft analysis). If you installed those versions that day on a home Mac or Windows PC, run the svc-telemetry check, use Cursor’s cleanup scripts if the key is there, and change your passwords and keys from a clean computer.

Image: Official Cursor logo from cursor.com.