Cursor warned of malicious Anthropic.claude-code 2.1.312 and 2.1.313 builds in its extension marketplace

Archive entry: this covers an event from October 29, 2026, and we published it on November 8, 2026. The details come from sources dated at the time and may have changed since.

On October 29, 2026, Cursor published a security notice about the malicious Anthropic.claude-code extension. Cursor said that versions 2.1.312 and 2.1.313, which were not developed by Anthropic, were available in the Cursor VS Code Extension Marketplace that day from about 2:27am to 1:35pm PT, and it listed Windows and macOS as affected. The notice was updated on October 30, 2026 at 11:30 am PT with revised indicators.

What Cursor reported

• The code collected host details, including computer and account name, OS and architecture, home folder, environment variable names, working folders, Git email and public IP address.
• It added an attacker SSH key with the comment svc-telemetry to authorized_keys and tried to enable SSH and a reverse tunnel. Cursor said enabling SSH would generally fail without admin rights.
• It installed persistence through the LaunchAgent com.apple.sysmond on macOS and the scheduled task SysMon on Windows.
• Cursor removed the versions, shut the marketplace down, audited access, rotated its keys, rebuilt the marketplace and brought it back online, and worked with the hosting provider to take down the malicious server.
• Cursor said it had no evidence that other versions of the extension or the official distribution were affected, and that its audit confirmed no other extensions were tampered with.
• The notice did not give a count of affected users.

What it meant for builders

Anyone who installed or updated the Claude Code extension inside Cursor on October 29, 2026 needed to check for the backdoor and rotate credentials. Cursor warned that uninstalling the extension may not be sufficient, because the payload drops standalone persistence scripts.

Remediation steps

• Check authorized_keys for the svc-telemetry key and remove it.
• Remove the persistence entries and tunnel processes, and rotate credentials and sessions accessible from affected hosts.
• Use the scripts remediate-macos.sh and remediate-windows.ps1 that Cursor published, and send questions to security@cursor.com.

Sources

• Security notice - malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace (Cursor, October 29, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.