A tampered Claude Code extension reached Cursor users. Check your machines

Before your team opens Cursor again, run one command on the Mac and Windows machines that have it. On October 29, 2026, a tampered copy of the Claude Code extension sat in Cursor's extension marketplace for about eleven hours, and it tried to leave a way back into the machines that installed it.

Everything below comes from Cursor's security notice and Microsoft's analysis of the injected code, which we read on November 11, 2026.

Versions 2.1.312 and 2.1.313 of `Anthropic.claude-code` for macOS and Windows were modified by someone other than Anthropic. Cursor says they were available between about 2:27am and 1:35pm Pacific time. Anthropic told Microsoft that its own systems were not compromised and that it did not build those packages.

When the extension loaded, the added code collected the machine's hostname, username, operating system, architecture, home folder, working folders, environment variable names, configured Git email and public IP address. It then tried to add an SSH key labelled `svc-telemetry` to the machine's authorised keys, switch on the local SSH service and hold a reverse tunnel open. On macOS it wrote a LaunchAgent, on Windows a scheduled task, so the tunnel would come back after a restart. Background scripts retried about every 60 seconds.

Two things limit the damage. Cursor says the attacker's server is offline, so the tunnel and the report of host details no longer reach anyone. Turning on the SSH service needs administrator rights, which the extension did not have on most machines, so that step failed on those.

The rest is still on the machine. The key was appended, the persistence was written and the host details were collected before any of that. Cursor says uninstalling the extension may not remove it, because the payload drops its own scripts that keep running. That is why both companies tell you to check and clean every machine that took the version rather than assume a failed login meant nothing.

On a Mac, run this in Terminal:

`grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"`

On Windows, run this in PowerShell:

`$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }; if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }`

A "key found" result means the machine was affected. A "No key found" result means this key is not on it.

Cursor's order is worth following as written:

1. 1Run its validation script for the platform and search endpoint, network and extension-install records for the indicators it publishes.
2. 2Isolate the machine from the network.
3. 3Remove the unauthorised SSH key, the persistence entries and any running tunnel process.
4. 4Decide whether to rebuild the machine.
5. 5Rotate the credentials and sessions that machine could reach, from a different machine.

Cursor publishes a remediation script for macOS and for Windows, which remove the extension, the persistence and the key and exit with a non-zero status if anything is left.

On a machine that holds client records, finance access or stored passwords, our own call is a rebuild rather than a cleanup. A rebuild costs an afternoon. A backdoor nobody is sure about costs a lot more. We cover the same reasoning in our guide to trust boundaries for self-hosted agents.

Microsoft confirmed the tampered packages were never published to the Visual Studio Marketplace or to npm as `@anthropic-ai/claude-code`. A team that installs Claude Code with `npm install -g @anthropic-ai/claude-code` or from the standard VS Code marketplace was not part of this incident. Cursor says it audited access and found no other extension tampered with, then rebuilt the marketplace and rotated its keys.

So the exposure is narrow: macOS and Windows machines that took version 2.1.312 or 2.1.313 from the Cursor marketplace during those eleven hours.

The extension arrived through an automatic update. Microsoft's guidance names systems that installed or automatically updated to the version. Someone opened the editor and the extension changed in place, with no decision and no review.

That is how most software reaches staff machines, and it is the part worth fixing. The advice to install only what you trust assumes somebody chooses each install.

• Write down which editor and which extensions each machine runs, and who needs each one.
• Turn off automatic extension updates on the machines that touch client records, then update on a set day after reading the vendor's release notes. Most editors leave that setting on.
• Install Claude Code from Anthropic's own instructions first. Treat a marketplace copy as the second choice and check the version while you are there.
• Give one person the job of reading security notices from the tools you depend on, with a way to reach every machine owner in one message.
• Record what each machine can reach. That is the difference between a rebuild decision that takes ten minutes and one that takes a week.

If nobody on the team uses Cursor, or the editor runs on a machine with no access to client records, mail or passwords, the check is a two-minute confirmation and nothing else is needed.

If staff laptops run coding agents and AI assistants, the work that prevents this kind of morning is a list of machines, what each one can reach, and what happens when a vendor posts a notice like this one. Our AI agents service covers builds with those limits baked in, and the free automation audit is where we check what your current setup can already reach.

Two related posts cover the same question from other angles: the checks before you connect an MCP server and a planted AGENTS.md in the Downloads folder.

Run the key check on every Mac and Windows machine that runs Cursor, then decide which of them need a rebuild.