Malicious Claude Code 2.1.313 Extension in Cursor: What It Did and How to Check, Checked

On October 29, 2026 Cursor published a security notice: a tampered copy of Anthropic's Claude Code extension, version 2.1.313, was available in the Cursor VS Code extension Marketplace for about eleven hours that day (by our calculation from its times). Cursor says this version "was not developed by Anthropic", that at most 5,000 users were affected, and that it will contact them directly. A diagram of the attack chain has been going around on X since; this guide sets out what the official notice actually says, what the extension tried to do, and how to check a machine.

Everything below comes from Cursor's notice and from Anthropic's own Claude Code changelog and docs. We did not run or analyse the extension ourselves.

What happened

Cursor says it audited access and found no other extensions tampered with, and that it has "no evidence that other versions of the extension or the official distribution are affected". Anthropic's own Claude Code changelog has no 2.1.313 entry at all: it goes from 2.1.312 straight to 2.1.314. As of October 30 we found no statement about the incident from Anthropic on its changelog or in the Claude Code repository.

What the extension tried to do

Two details in the notice matter for judging the damage:

• The tunnel mostly failed. Turning on the local SSH service needs administrator rights, which the extension does not have on most macOS and Windows machines. Cursor also says errors in the malicious code made this step fail except when Cursor itself was started as administrator. On those machines the attacker "could not have logged in through the tunnel".
• The rest still ran. Even where the tunnel failed, the extension still added the attacker's key, installed its persistence and sent the host details. Environment variable names, not their values, are in the list of what it collected, but Cursor warns that this "does not rule out later credential access over the backdoor".

How to check your machine

You only need to check if you installed or updated Claude Code 2.1.313 from Cursor's marketplace during that window on October 29. The tell-tale sign is the attacker's key, labelled svc-telemetry. Cursor gives this one-line check for macOS:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, Cursor's notice has the PowerShell version, which also looks in C:\ProgramData\ssh\administrators_authorized_keys.

If the key is there, Cursor's advice is:

1. Isolate the machine.
2. Run Cursor's remediation script for your platform (linked from the notice), which removes the extension, the persistence, the tunnel processes and the key. Uninstalling the extension alone "may not be sufficient", because the dropped scripts keep running on their own.
3. Decide whether the machine should be rebuilt.
4. Rotate the credentials and sessions that machine could reach, from a different, trusted computer.

Other signs listed by Cursor: on macOS the files ~/.config/.smt and ~/.config/.smtk and a LaunchAgent named com.apple.sysmond (not an Apple component, despite the name); on Windows a scheduled task called SysMon and smt.cmd in your .config folder. The notice also has the file hashes and network indicators for security teams.

What the viral diagram gets right, and what to add

The diagram shared on X matches the notice on the main steps: the planted svc-telemetry key, the reverse tunnel, the com.apple.sysmond LaunchAgent, the ~/.config/.smt script, the host profile and the /beacon endpoint on port 8099. Three things it does not show:

• Where it was distributed. The notice is about Cursor's extension marketplace. Anthropic's changelog never listed a 2.1.313, and Cursor says it has no evidence the official distribution was affected.
• That the tunnel usually failed. Without administrator rights the SSH step fails, so for most users the realistic exposure is the planted key, the persistence and the leaked host details, not an open door.
• That the server is down. Cursor and the hosting provider took the attacker's server offline, so the tunnel and the beacon no longer reach anyone. The cleanup is still needed.

Lessons for anyone running coding agents in an editor

• Know where your extension comes from. Anthropic's VS Code docs give one-click install links for VS Code and for Cursor, and say other VS Code forks install it from their Extensions view or the Open VSX registry. Each of these is a separate distribution channel with its own security.
• The version number should match a release. The extension's version is the Claude Code version it bundles, per Anthropic's docs, so a version that is missing from the official changelog deserves a second look.
• Extensions run with your rights. An editor extension can write to your home folder and start background processes; that is why this one could plant a key and a LaunchAgent. Keep an eye on ~/.ssh/authorized_keys and your login items.
• This is the second supply-chain hit on AI coding tooling this month. Earlier, LiteLLM 1.107.0 shipped with a credential stealer; see our news feed.

Our pages: Claude Code and Cursor; for limiting what an agent can touch, see Claude Code deploys: 6 open-source repos for a containment system.

The verdict

The incident is real and confirmed by Cursor, the marketplace that distributed the file. Version 2.1.313 is not an Anthropic release. If you installed it in Cursor on October 29, check for the svc-telemetry key and clean up with Cursor's script even if the tunnel never worked. If you did not, nothing to do beyond the usual: install Claude Code from the links in Anthropic's docs and compare versions with the changelog.

Facts and times are from Cursor's security notice of October 29, 2026 and Anthropic's Claude Code changelog and docs (read on October 30, 2026). We did not run the extension or the remediation scripts.