Cursor pulls Claude Code 2.1.313 after SSH backdoor found

Cursor pulled a tampered build of Anthropic’s Claude Code extension, Anthropic.claude-code 2.1.313. The build sat in Cursor’s VS Code extension marketplace from about 2:27am to 1:35pm PT on October 29 and runs code that tries to plant a persistent SSH backdoor, Cursor said in its security notice. If you installed or updated to that version in that window, check your SSH authorized keys for an entry labelled svc-telemetry. If it is there, uninstalling the extension won’t clean the machine, because the payload drops standalone persistence scripts that keep running.

At most 5,000 users were affected, and Cursor says it will contact them directly. The attacker’s server is down: Cursor worked with the cloud provider hosting it to take it offline, so the reverse tunnel and the host-detail reports no longer reach anyone. Cursor still tells affected users to follow its remediation steps.

Checking a machine

The malicious extension appends the attacker’s public key to your authorized keys file, so the key is the test. On macOS, Cursor’s check is grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted". On Windows, in PowerShell: $files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ } if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }.

If the key is found, Cursor’s steps are to isolate the host, remove the key, the persistence and the running tunnel processes with its remediation scripts, decide whether the host should be rebuilt, and rotate every credential and session reachable from that machine, working from a trusted system. On macOS, run bash remediate-macos.sh as the affected user and not as root. On Windows, open PowerShell with Run as Administrator and run powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1. Both scripts remove the extension, the persistence, the tunnel processes and the key, and exit with a non-zero status if anything remains.

Teams with endpoint and network telemetry can search for the indicators Cursor published:

• Modified VSIX SHA-256, darwin-arm64: 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62; win32-x64: 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081
• Network: the attacker endpoint 134[.]209[.]82[.]225, reverse SSH as tunnel@ that host on TCP 22, and HTTP POSTs to port 8099 /beacon, plus a loopback attempt to 127[.]0[.]0[.]1:8099. Lookups to ifconfig[.]me and api[.]ipify[.]org are legitimate services and are not an indicator on their own.
• macOS files: ~/.config/.smt, ~/.config/.smtk, $TMPDIR/.stk_<10 hex> and ~/Library/LaunchAgents/com.apple.sysmond.plist
• Windows: %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, %TEMP%\.stk_<10 hex>, a scheduled task named SysMon, and a fallback sysmon.cmd in the Startup folder
• Processes: ssh -N -R '*:0:localhost:22', autossh -M 0, systemsetup -setremotelogin on, schtasks /create /tn SysMon

The key fingerprints and the full set of SSH options are in Cursor’s notice. Kevin Beaumont of DoublePulsar, who covered the incident, has published KQL queries for hunting the malicious version with Microsoft Defender for Endpoint.

What the payload does

The extension first collects the hostname, username, OS, architecture, home directory, working directories, configured Git email, public IP and the names of environment variables. It then tries to add the attacker’s key, turn on the local SSH service and open a reverse SSH tunnel, in which the infected machine dials out to the attacker’s server and opens a way back in. It makes the tunnel persistent through a LaunchAgent on macOS, or on Windows through a scheduled task that tries to run as SYSTEM, with a Startup script as fallback. Background scripts retry the tunnel roughly every 60 seconds, and the host details and backdoor status go out by HTTP POST.

Turning on the SSH service needs admin rights, which the extension lacks on most macOS and Windows hosts. Cursor adds that errors in the malicious code make this step fail unless Cursor was started with administrator privileges. On those hosts the attacker could not have logged in through the tunnel, so what stood between most machines and a working backdoor was only the attacker’s own bugs and a missing privilege. The key, the persistence and the beacon still landed, which is why Cursor asks for cleanup either way.

Per The Hacker News, the collected variable names are capped at 40 and limited to names containing KEY, TOKEN, SECRET, PASS, AWS or GCP. Researcher Paul McCarty said the values are not placed directly in the initial beacon, but the names can still reveal information. Cursor makes the same point from the other side: the limited collection does not rule out later credential access over the backdoor, hence the rotation step. The Hacker News also reports that the code tries to make the victim reachable over SSH on Linux as well, with a crontab entry among its persistence methods. Cursor’s published hashes, check commands and scripts cover only macOS and Windows.

Jenn Gile of OpenSourceMalware found the payload as a 66-line loader inserted before the legitimate code in the package’s main JavaScript bundle. The build went out under Anthropic’s real extension ID, as an update rather than a lookalike extension.

Whose build was it?

Cursor’s notice says the malicious version “was not developed by Anthropic.” Beaumont, who says the security firm Phorion first spotted the malicious activity on endpoints, counters that it was uploaded as Anthropic’s verified account and that “‘Developed’ is doing some heavy lifting.” He also writes that the extension auto-updated to the malicious version in Cursor, so users did not have to install anything themselves. How the attackers got the update published is still unclear.

The Hacker News reports that the bad build was distributed only through Cursor’s marketplace, with no evidence it reached Open VSX or Microsoft’s VS Code Marketplace. Beaumont notes that 2.1.313 is now missing from Open VSX, the Visual Studio Marketplace and Cursor alike. He adds that Anthropic replaced it with 2.1.314, which appears to remove the backdoor from the extension but does nothing about a backdoor or recon data already on an infected machine. Updating does not count as cleanup.

Cursor says it removed the version as soon as it detected it, then shut down its whole VS Code extension marketplace as a precaution. It audited access, found no other tampered extensions, rotated its keys, rebuilt the marketplace and brought it back online. It says it has no evidence that other versions of the extension or the official distribution are affected. Questions go to security@cursor.com.