A Malicious "Claude Code" Extension Hit the Cursor Marketplace — What It Did and How to Check Your Machine

For about 11 hours on October 29, 2026, a tampered build of the Claude Code extension sat live in Cursor's VS Code marketplace — and if you installed it, it tried to plant a backdoor SSH key on your machine and phone home every 60 seconds.

This isn't a hypothetical. Cursor confirmed it in a public security notice on October 29, 2026: cursor.com/blog/claude-code-extension-security-notice. The affected package was Anthropic.claude-code version 2.1.313 — not built by Anthropic, not the official distribution, and not affecting any other version. It sat in Cursor's marketplace (a separate catalog from the official VS Code Marketplace) from roughly 2:27am to 1:35pm PT. Cursor says at most 5,000 users installed it before they shut the listing down, rebuilt the marketplace, and rotated keys.

Whether you use Cursor or not, the mechanics here are worth understanding, because this is exactly the shape of attack that will hit some other IDE extension catalog next. Here's what it actually did, the one check that tells you if you were hit, and how to actually clean it up — because uninstalling the extension is not enough.

What happened, step by step

Once installed, the two affected builds — darwin-arm64 and win32-x64 — ran a payload that did five things:

• Reconnaissance. Collected your hostname, username, OS, home directory path, the names (not values) of your environment variables, your git email, and your public IP.
• Backdoor key. Appended an attacker-controlled public key to ~/.ssh/authorized_keys, labeled with the comment svc-telemetry — deliberately named to look like a legitimate monitoring service if you ever skimmed the file.
• Reverse tunnel attempt. Tried to enable the local SSH daemon and open a persistent reverse SSH tunnel back to an attacker-controlled host. This step usually failed on machines where the user didn't have local admin/root rights — but it still tried, on every run.
• Persistence. Installed itself to survive a reboot and an extension uninstall: a LaunchAgent named com.apple.sysmond on macOS, or a scheduled task named SysMon on Windows. Both names are chosen to blend into normal OS process lists.
• Beacon. Retried the whole sequence roughly every 60 seconds, and sent a beacon to the attacker's server on port 8099 at the path /beacon.

Cursor says the attacker's server is now down. That matters for the "is it still exfiltrating data right now" question, but it does not matter for the "is there still a key sitting in my authorized_keys file" question — that part doesn't go away on its own.

Why uninstalling the extension isn't enough

This is the part people get wrong. The extension was the delivery mechanism, not the persistence mechanism. Once it ran once, it had already:

• Written a line to authorized_keys that has nothing to do with the extension being installed or not.
• Registered a LaunchAgent or scheduled task that keeps running independently of VS Code or Cursor.

Remove the extension and both of those survive untouched. You have to go find and remove them separately.

The exact check: find out if you were hit

Below is a real diagnostic script — not a sketch of one — that checks for every artifact Cursor's notice describes. Run the block for your OS. Nothing here needs admin rights to check; you only need elevated rights for the cleanup step afterward if it finds something.

macOS / Linux:

#!/usr/bin/env bash
# check_claude_code_backdoor.sh
# Checks for the artifacts left by the tampered Anthropic.claude-code 2.1.313
# extension described in Cursor's Oct 29, 2026 security notice.

set -uo pipefail
FOUND=0

echo "== Checking ~/.ssh/authorized_keys for the svc-telemetry key =="
if [ -f "$HOME/.ssh/authorized_keys" ]; then
    if grep -n "svc-telemetry" "$HOME/.ssh/authorized_keys"; then
        echo "  [!] FOUND: a key labeled svc-telemetry is present."
        FOUND=1
    else
        echo "  [ok] No svc-telemetry entry found."
    fi
else
    echo "  [ok] No authorized_keys file exists."
fi

echo
echo "== Checking for the com.apple.sysmond LaunchAgent (macOS persistence) =="
PLIST="$HOME/Library/LaunchAgents/com.apple.sysmond.plist"
if [ -f "$PLIST" ] || launchctl list 2>/dev/null | grep -q "com.apple.sysmond"; then
    echo "  [!] FOUND: com.apple.sysmond is registered."
    [ -f "$PLIST" ] && echo "      plist: $PLIST"
    FOUND=1
else
    echo "  [ok] com.apple.sysmond not found."
fi

echo
echo "== Checking recent outbound connections to the beacon port (8099) =="
if command -v lsof >/dev/null 2>&1; then
    MATCHES=$(lsof -i :8099 -sTCP:ESTABLISHED 2>/dev/null)
    if [ -n "$MATCHES" ]; then
        echo "  [!] FOUND: an active connection on port 8099:"
        echo "$MATCHES"
        FOUND=1
    else
        echo "  [ok] No active connection on port 8099 right now (the attacker's server is reportedly down, so absence here doesn't rule out a past hit)."
    fi
else
    echo "  [skip] lsof not available, skipping live-connection check."
fi

echo
if [ "$FOUND" -eq 1 ]; then
    echo "RESULT: artifacts found. See the remediation steps below before you do anything else."
else
    echo "RESULT: no artifacts found. You're clean on this specific threat."
fi

Windows (PowerShell):

# Check-ClaudeCodeBackdoor.ps1
$found = $false

Write-Host "== Checking authorized_keys for the svc-telemetry key =="
$authKeys = "$env:USERPROFILE\.ssh\authorized_keys"
if (Test-Path $authKeys) {
    $hit = Select-String -Path $authKeys -Pattern "svc-telemetry"
    if ($hit) {
        Write-Host "  [!] FOUND: $hit"
        $found = $true
    } else {
        Write-Host "  [ok] No svc-telemetry entry found."
    }
} else {
    Write-Host "  [ok] No authorized_keys file exists."
}

Write-Host "`n== Checking for the SysMon scheduled task =="
$task = Get-ScheduledTask -TaskName "SysMon" -ErrorAction SilentlyContinue
if ($task) {
    Write-Host "  [!] FOUND: scheduled task 'SysMon' is registered (state: $($task.State))."
    $found = $true
} else {
    Write-Host "  [ok] No 'SysMon' scheduled task found."
}

Write-Host "`n== Result =="
if ($found) {
    Write-Host "Artifacts found. See the remediation steps below before you do anything else."
} else {
    Write-Host "No artifacts found. You're clean on this specific threat."
}

If the check finds something: how to actually fix it

Don't just delete the line and move on — treat this as a real compromise, because for the window the key was live, it was one. In order:

1. Remove the backdoor key. Open authorized_keys and delete the line containing svc-telemetry. Don't just overwrite the whole file blind — you may have legitimate keys in there too.
2. Kill and remove the persistence mechanism.

   # macOS
   launchctl unload ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null
   rm -f ~/Library/LaunchAgents/com.apple.sysmond.plist

   # Windows
   Unregister-ScheduledTask -TaskName "SysMon" -Confirm:$false

3. Rotate credentials — from a trusted, different machine. Don't do this from the machine you just found compromised. At minimum: regenerate any SSH keypairs that were on that machine, rotate any cloud/API credentials whose values could have been read from your environment or git config, and rotate your git-associated email-linked tokens if you use SSH-signed commits.
4. Consider whether a rebuild is warranted. If the reverse-tunnel step succeeded (it needed admin/root, so check whether you were running with elevated rights that day), treat the machine as having had a live remote shell available to an attacker, not just a dormant key, and weigh a full OS reinstall.
5. Use Cursor's own remediation path too. Cursor published an official check and remediation script alongside their notice — run that as well; it's built against their own telemetry of exactly what shipped.

The wider lesson

None of this depended on a flaw in Claude Code itself, or in Cursor's product. It depended on one thing: an attacker got a tampered build into a marketplace under a trusted name, and trust in the name was enough to get it installed. That's a supply-chain problem, and it generalizes to every IDE extension catalog, every package registry, every "it's from a name I recognize" moment.

The practical habit this should leave you with: treat IDE extensions like you'd treat any other third-party code with filesystem and network access — because that's exactly what they are. Pin versions where your tooling allows it. Periodically audit what's actually installed, not just what you remember installing. And know what your own authorized_keys file is supposed to contain, so an unfamiliar line actually stands out.

Check your authorized_keys and audit your IDE extensions — today, not after the next notice.

Mumuni Mohammed

Experienced DevOps Engineer proficient in Python, Docker, Kubernetes, CI/CD, and cloud technologies. Specialized in automating processes and building scalable infrastructure for seamless development and deployment.