On October 29, 2026, Cursor said modified Anthropic.claude-code versions 2.1.312 and 2.1.313 were available through its VS Code extension marketplace for Windows and macOS. Cursor estimated that up to 5,000 users could have received them. Its security notice gives the exposure window and guidance for checking affected hosts.
Which Claude Code versions Cursor identified
Cursor said the versions were available from about 2:27 a.m. to 1:35 p.m. Pacific Time on October 29. The estimate of up to 5,000 users is a potential-recipient figure, not a count of confirmed infections.
What the modified extension attempted to do
Phorion’s technical analysis says the injected code ran when the extension module loaded, without requiring the user to start a Claude conversation. The payload attempted to add an SSH public key labeled svc-telemetry, enable SSH on the host, open a reverse SSH tunnel, and maintain persistence after a restart. It used a macOS LaunchAgent and, on Windows, attempted a scheduled task with a Startup-folder fallback.
The payload also attempted to collect host details, including the hostname, username, operating system, working directories and public IP address. Phorion says it collected up to 40 matching environment-variable names, not their values. Cursor cautioned that credentials accessible on a host could still be exposed if the backdoor worked.
Cursor said SSH enablement would fail on most Windows and macOS hosts because of code errors and administrator-permission requirements. The company also warned that a key, persistence artifacts or host details could still have been left or sent.
How to check and remediate a potentially affected host
Cursor removed the malicious versions, blocked their distribution, took its marketplace offline as a precaution, audited other extensions, rotated its own keys, and rebuilt and restored the marketplace. Cursor also said the attacker’s server had been taken offline.
For a potentially affected Windows or macOS host, Cursor recommends checking for svc-telemetry in the SSH authorized_keys file, including the administrators’ file on Windows. It also recommends reviewing endpoint, network and extension-installation indicators. Cursor provides separate remediation scripts for Windows and macOS.
If there is evidence of compromise, isolate the host, remove unauthorized keys and persistence mechanisms, and investigate running tunnel processes. Rotate credentials and sessions that were accessible from the host, using a trusted system. Cursor warns that updating or uninstalling the extension may leave standalone persistence scripts behind; it also recommends considering a rebuild of the host.
