Claude Code Extension Malware: Find and Remove the Backdoor

Short answer: on 29 October 2026, Cursor’s extension marketplace served tampered builds of the Claude Code extension, versions 2.1.312 and 2.1.313, for Mac (Apple Silicon) and Windows, for about 11 hours. They added an attacker’s SSH key labelled svc-telemetry to your authorized_keys file and set up a task that starts again after every reboot. Updating the extension does not remove either one. To clean up: check your extension folder, search both SSH key files for unknown keys, remove the startup task and hidden scripts, then change your secrets from a different, trusted device.

Watch the video (about 10 minutes):

How I checked this. The facts in this guide come from Cursor’s official security notice (29 October 2026, updated 30 October) and from the researcher write-ups by Phorion and OpenSourceMalware, checked on 7 November 2026. Where an early report and Cursor’s notice disagree, I follow Cursor. I’m not affiliated with Cursor or Anthropic. If this is a work machine, tell your security team before you change anything.

What happened, in 60 seconds

Where: only Cursor’s own extension marketplace. Cursor says the official VS Code Marketplace, Open VSX and the Claude Code npm package were not affected. Some early reports named Open VSX; that was later corrected.
Which versions: anthropic.claude-code 2.1.312 and 2.1.313, built for darwin-arm64 (Mac with Apple Silicon) and win32-x64 (Windows).
When: 29 October 2026, roughly 09:27 to 20:35 UTC.
How many: Cursor says up to 5,000 users received them.
Who built them: Cursor says these versions were not developed by Anthropic.

A small loader was added to the top of the extension’s code. It ran the moment Cursor loaded the extension, so you didn’t need to open a chat. It:

Appended an ed25519 SSH key labelled svc-telemetry to ~/.ssh/authorized_keys.
Tried to turn on the machine’s SSH service.
Tried to open a reverse SSH tunnel (ssh -N -R) out to the attacker’s server.
Set up persistence that retries about every 60 seconds and survives reboots.
Sent out host details: username, computer name, OS, public IP, Git email, working folder and the names of your environment variables.

The good news: turning on SSH needs admin rights, and bugs in the malware made that step fail on most machines. Cursor says that on those machines the attacker could not log in through the tunnel, and the attacker’s server is now offline.

The bad news: the key, the startup task and the data upload still happened. If SSH is ever turned on later, that key works again. So you clean up anyway.

Step 1: Check your Claude Code extension version

In Cursor, open the Extensions panel, search for Claude Code, and read the version under the name. That only shows what is installed now, though. If it already updated, the old folder can still be on disk, so check the folder too.

Mac (Terminal):

ls ~/.cursor/extensions | grep -i claude-code

Windows (PowerShell):

Get-ChildItem "$env:USERPROFILE\.cursor\extensions" | Where-Object Name -like "*claude-code*"

Look for a folder name that contains 2.1.312 or 2.1.313, for example anthropic.claude-code-2.1.313-darwin-arm64. If you only see 2.1.314 or newer, and you never had those two versions, you’re very likely fine. If you see one of them, or you’re not sure, keep going. Linux builds weren’t in the affected list, but researchers saw a cron @reboot entry in the code, so Linux users who ran Cursor that day can do the same checks.

Step 2: Hunt for unknown SSH keys

Your authorized_keys file is the guest list for your machine. Any key in it can log in as you, with no password.

Mac:

grep -n svc-telemetry ~/.ssh/authorized_keys

If it prints a line, the backdoor key is there. Cursor’s official one-line check:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Windows (PowerShell), checking both key files:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

Don’t stop at that one word. A smarter attacker changes the label next time. List every key with its fingerprint:

ssh-keygen -lf ~/.ssh/authorized_keys

You get one line per key, for example:

256 SHA256:Xp3...  abd@mouhimen-mbp (ED25519)
256 SHA256:Lk9...  deploy@mouhimen.dev (ED25519)
256 SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk svc-telemetry (ED25519)

For each line ask one question: do I know where this key came from? My laptop, yes. My deploy key, yes. Anything you can’t explain, treat as hostile. The fingerprint of the bad key in this attack is SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk.

Then check whether SSH is switched on:

# Mac
sudo systemsetup -getremotelogin

# Windows
Get-Service sshd

If it says On or Running and you never turned it on yourself, take it seriously. That’s the one case where the key could actually let someone in.

Step 3: Remove the backdoor and its hiding spots

Remove the key

Back up the file first, then delete only the bad line and save. Leave your real keys alone.

cp ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak
nano ~/.ssh/authorized_keys   # delete the svc-telemetry line, save

On Windows, edit both files if the key is in both.

Mac: the launch agent and hidden scripts

The Mac persistence is a launch agent in your user Library folder, disguised with an Apple-style name, plus two hidden scripts:

ls ~/Library/LaunchAgents
launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/com.apple.sysmond.plist
rm ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk

Researchers also saw temporary files named $TMPDIR/.stk_*; delete those if they exist.

Windows: the scheduled task and fallbacks

Look at what the task runs before you remove it:

Get-ScheduledTask -TaskName SysMon | Select-Object -ExpandProperty Actions
Unregister-ScheduledTask -TaskName SysMon -Confirm:$false

If the task couldn’t be created, the malware falls back to a Startup file. Delete these too if they exist:

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd
%USERPROFILE%\.config\smt.cmd
%USERPROFILE%\.config\smtk

Kill any running tunnel

# Mac
ps aux | grep -E "ssh -N -R|autossh"

# Windows
Get-CimInstance Win32_Process -Filter "Name='ssh.exe'" | Select-Object ProcessId, CommandLine

If you never use SSH on this machine, turn the SSH service back off.

Remove the extension and reinstall

Delete the bad extension folder, restart Cursor, and install the current Claude Code version.

The easiest route is Cursor’s own cleanup script, linked from the notice: remediate-macos.sh (run it as your normal user, not with sudo) and remediate-windows.ps1 (run PowerShell as Administrator). It stops with an error if anything is left behind.

Step 4: Change your secrets

Even where the tunnel failed, the malware ran code as you, and Cursor says to rotate any credentials that machine could reach. Plan as if anything on the disk could have been read:

GitHub personal access tokens and SSH keys (~/.ssh/id_ed25519)
Cloud CLI credentials (AWS, Google Cloud, Azure config folders)
API keys and database passwords in .env files, for example a Laravel APP_KEY and DB_PASSWORD
npm, Composer and other registry tokens

Do it from a trusted device, not the machine you’re cleaning. On GitHub, also check Settings > SSH and GPG keys and Sessions for anything new.

From my own Laravel and Next.js work, the file people forget is .env. It’s never committed to Git, so it feels safe. A backdoor doesn’t care about Git. It reads the disk.

3 mistakes that leave you exposed

1. “I updated, so I’m clean.” Updating replaces the extension folder. The key, the launch agent, the scheduled task and the hidden scripts all live outside it, and they stay until you remove them.

2. Deleting the wrong thing. On Windows there’s a real Microsoft tool called Sysmon (from Sysinternals) that runs as a service. The bad one is a scheduled task named SysMon. Check what the task runs before you remove anything. On Mac, real Apple agents live in /System/Library and /Library, not in ~/Library. A com.apple name in your own user folder is a disguise.

3. Checking only one key file on Windows. If your Windows account is an administrator, OpenSSH ignores %USERPROFILE%\.ssh\authorized_keys and reads C:\ProgramData\ssh\administrators_authorized_keys instead. You can clean your own file, see nothing, and still have the key in the other one. That’s why Cursor’s own check searches both files.

The setting that stops this next time

In Cursor’s settings, search for extensions auto update and turn it off, or set it to notify only. Then update important extensions yourself a day or two after a release, once you’ve had a chance to see the news. That small delay would have kept you out of this entire 11-hour window.

Checklist

[ ] Checked ~/.cursor/extensions for 2.1.312 / 2.1.313
[ ] Searched for svc-telemetry (both key files on Windows)
[ ] Listed every key with ssh-keygen -lf and removed unknown ones
[ ] Removed the launch agent (Mac) or SysMon task and Startup file (Windows), plus the hidden scripts
[ ] Killed any ssh -N -R tunnel and turned SSH off if unused
[ ] Reinstalled the current extension (or ran Cursor’s cleanup script)
[ ] Rotated tokens, keys and .env secrets from a trusted device
[ ] Turned off extension auto update

FAQ

Was the official Claude Code extension on the VS Code Marketplace affected?
No. Cursor says only its own marketplace served the tampered builds. The VS Code Marketplace, Open VSX and the npm package were not affected.

Did Anthropic publish the bad versions?
Cursor says the versions were not developed by Anthropic. They were served through Cursor’s marketplace under the Claude Code listing.

I’m on 2.1.314 now. Am I safe?
Only if you never had 2.1.312 or 2.1.313. If you did, the key and the startup task are still there after the update. Run the checks above.

The SSH step failed on my machine. Do I still need to rotate secrets?
Yes. The loader still ran code as your user and sent out host details, so Cursor recommends rotating credentials the machine could reach.

I use Linux. Should I worry?
The affected builds were for Mac and Windows. If you ran Cursor on Linux that day, the same checks take two minutes, so run them anyway.

What if I find the key but SSH was off?
Cursor says the attacker couldn’t log in on machines where SSH stayed off. Remove everything anyway, because the key would work the day SSH is turned on.

Keep learning

Find and Remove a Keylogger on Windows: hunt startup tricks and hidden tasks
LiteLLM Backdoor Explained: another AI developer tool supply-chain attack
Ollama Exposed: lock down a local AI server
Laravel API Tutorial for Beginners: where your .env secrets live
Claude AI Tutorial for Beginners: start the free Mastering Claude & Claude Code course
Next: Ubuntu Server Security: 10 Hardening Steps (SSH keys, firewall, Fail2ban), coming 30 November

Sources

Cursor, “Claude Code extension security notice”, 29 Oct 2026 (updated 30 Oct): https://cursor.com/blog/claude-code-extension-security-notice
Phorion, technical analysis of the trojanized Claude Code extension
OpenSourceMalware, write-up and correction on affected marketplaces
Microsoft Learn, OpenSSH key management for Windows (administrators_authorized_keys)