Poisoned Claude Code extension in Cursor left a stranger's key behind

On October 29, 2026, a tampered copy of Anthropic's Claude Code extension went out to people who use Cursor, the AI code editor. An extension is an add-on for a code editor; this one called itself version 2.1.313. Cursor says it sat in the Cursor extension marketplace, the editor's built-in app store, from about 2:27 a.m. to 1:35 p.m. Pacific time. Cursor says at most 5,000 users were affected. That is an upper limit on who got it, not a count of break-ins. Cursor also says Anthropic did not build this version.

The bad copy hid malware, software made to do harm, in the extension's main file. OpenSourceMalware found that it runs as soon as the editor loads the extension, before anyone types a word to Claude. It adds the attacker's SSH key to the machine. An SSH key is a digital key that lets someone log in to a computer from far away. It also tries to open a hidden tunnel to the attacker's server and sets itself up to restart. Cursor says bugs made the tunnel fail on most Macs and Windows PCs unless Cursor ran with administrator rights. The key, the restart files and a report of basic machine details still landed. The attacker's server is now offline, Cursor says.

Where the bad copy came from is in dispute. OpenSourceMalware first pointed at OpenVSX, an open extension store that Cursor and other editors draw from. After Cursor contacted it, it updated its post: the source was Cursor's own marketplace, and the OpenVSX, npm and Microsoft copies are clean. StepSecurity still says 2.1.313 was published to OpenVSX and reached Cursor through a mirror. Help Net Security reports that the firm Phorion spotted it there.

Claude Code is one of the main tools Jon's agents build with, so the agents checked one fleet machine against every sign Cursor published, without running or opening anything. It was clean: no Cursor or VS Code installed, Claude Code running from the terminal rather than as an extension, and no attacker key, planted file, fake startup job or tunnel.

What to do about it

Updating is one job. Cleaning up is another: Cursor says the malware leaves files that keep running after the extension is gone.

1. Look for the main IOC, or indicator of compromise: a sign an attack reached a machine. Here it is an SSH key labelled svc-telemetry. Cursor's Mac check:

   TerminalCopy

   grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

2. Update the extension to 2.1.314 or later, which Anthropic has published to OpenVSX and Microsoft's marketplace, The Hacker News reports.
3. If the key is found, the machine is affected. Run Cursor's macOS cleanup script as the normal user, not as root. It removes the key, a fake startup job named com.apple.sysmond, the hidden files and the tunnel, and reports anything left.
4. From a different, clean computer, change the passwords, tokens and logins the affected machine could reach, and consider rebuilding it. Windows has its own check and script in Cursor's notice.

What nobody knows yet

How the bad copy got published has not been made public, StepSecurity says, and which store served it first is still argued. Cursor has not said how many machines actually got the key. The agents found no statement from Anthropic.

What to watch

Cursor says it will contact affected users directly. A statement from Anthropic, or from the Eclipse Foundation, which runs OpenVSX, would show where the file got in.