For eleven hours, code editor Cursor distributed a booby-trapped Claude Code extension

On October 29, at 10:27 a.m. (Paris time), a new version of the Claude Code extension appeared in the extension store of Cursor, a code editor widely used by developers. Nothing set it apart from an ordinary update, but it was not developed by Anthropic. It remained available until 9:35 p.m., about eleven hours. According to BleepingComputer, it may have reached up to 5,000 developers.

Claude Code is Anthropic's programming assistant. In its security advisory, updated on October 30, Cursor identifies versions 2.1.312 and 2.1.313 for Windows and macOS, distributed only through its own store. After conflicting reports, BleepingComputer says neither Open VSX nor Microsoft's store distributed the booby-trapped version. Cursor says it found no sign that other versions or the official distribution were affected.

A backdoor that partly failed

According to Cursor, the malicious code ran as soon as the extension loaded, with no action from the user. It collected the machine name, the username, the public IP address and the Git email address, then sent them to a server. It then tried to add an SSH key belonging to the attacker, named svc-telemetry, enable the SSH service and open a reverse tunnel to keep remote access. To survive every reboot, it installed itself as a launch agent on macOS or as a scheduled task on Windows.

Enabling SSH requires administrator rights, which the extension generally does not have. Researchers at Phorion, cited by BleepingComputer, also found errors in the code that made this step fail. But adding the key, persistence and information collection could succeed. Cursor says the attacker's server was taken offline with the help of the hosting provider.

What should you do if you use Cursor?

If you installed or updated Claude Code in Cursor on October 29, don't just remove the extension: according to Cursor, uninstalling alone may not remove the key and the persistence mechanisms.

• Look for the svc-telemetry key in ~/.ssh/authorized_keys (macOS) or in %USERPROFILE%\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys (Windows).
• On macOS, check for ~/Library/LaunchAgents/com.apple.sysmond.plist; on Windows, for a SysMon scheduled task and a sysmon.cmd file in the startup folder.
• Look for connections to the address 134.209.82.225 (SSH on port 22, HTTP on port 8099).
• Use the cleanup scripts provided by Cursor, consider reinstalling the machine if the backdoor is present, and change, from another computer, any credentials accessible from the affected machine.

How did the attacker publish under Anthropic's name?

Cursor pulled the version, temporarily closed its entire store to audit the other extensions and rotated its access keys. But it has not explained how the attacker was able to publish this version under Anthropic's name. Anthropic, contacted by BleepingComputer, had not responded when the article was published. This is not the first time a developer tool has served as a Trojan horse: this month, a booby-trapped version of LiteLLM was already stealing cloud access. Until the cause is known, the trust placed in automatic extension updates deserves a second look.

Update of November 13, 2026

Anthropic has responded to the distribution, on October 29, of a fake version of its Claude Code extension in the store of the Cursor code editor. According to The Register, well-known cybersecurity figures claimed the extension had been published in Cursor's store following a breach at Anthropic. Felix Rieseberg, a member of Anthropic's technical staff, said on X that a “malicious actor used access to Cursor's store to publish a booby-trapped copy” of the extension. He says this was not a compromise of Anthropic's systems or of its employees' computers. According to him, the versions from Anthropic's official channels are not affected and only Cursor users are concerned.

How did the attacker get this access? The question remains open. According to researcher Kevin Beaumont and the company Phorion, cited by the site Implicator, the booby-trapped version was distributed via Anthropic's official account in Cursor's store. Cursor's advisory has not been changed since October 30: the company still has not explained how the booby-trapped version could be published, nor given the number of machines actually compromised. According to Implicator, it has only said the incident affected at most 5,000 users.

To find out whether a machine is affected, Cursor advises looking in the authorized_keys file for an SSH key with the comment “svc-telemetry.” Uninstalling the extension “may not be enough,” the company warns: the malicious payload drops persistence scripts that keep running. Cursor provides cleanup scripts for macOS and Windows and recommends changing, from a trusted system, the credentials and sessions accessible from the affected machines.