Malicious Claude Code Extension in Cursor: How to Check Your PC or Mac

An AI coding extension runs with your permissions, sees your code and can touch your SSH keys. On October 29, 2026, that trust was abused. A tampered copy of the Claude Code extension sat in Cursor’s marketplace for about eleven hours. Uninstalling it did not remove what it left behind.

01 / WHAT HAPPENEDEleven hours in a trusted marketplace

Cursor’s security notice says that between about 2:27 a.m. and 1:35 p.m. Pacific time on October 29, a maliciously modified Claude Code extension was available in the Cursor VS Code extension marketplace. On October 30, Cursor updated the notice to list two affected versions, 2.1.312 and 2.1.313, built for Apple-silicon Macs and 64-bit Windows.¹ Cursor says up to 5,000 users were affected and that it is contacting them directly.¹

Cursor removed the version and then shut down its whole marketplace as a precaution. It audited access and confirmed no other extensions were tampered with. It rotated its keys, rebuilt the marketplace and brought it back online. It also worked with the hosting provider to take the attacker’s server offline.¹

Anthropic told The Register that a malicious actor used access to Cursor’s marketplace to publish the tampered copy, and that versions on its official channels are not affected.² Early reports also named other registries. BleepingComputer later reported that Cursor was confirmed as the only source distributing the malicious extension.³ Cursor has not said publicly how the attacker got access to its marketplace.

02 / HOW IT WORKEDFive steps, no prompt needed

Researchers found that the attackers put a malicious JavaScript loader at the top of the extension’s extension.js file and left the rest of the code unchanged. It ran as soon as the editor loaded the extension. The user didn’t have to interact with Claude Code at all.³

03 / CHECK YOUR MACHINEOne-minute checks for Mac and Windows

Cursor’s notice gives one primary test: look for the svc-telemetry key in your SSH authorized keys. If it’s there, the machine is impacted.¹ The commands below are Cursor’s checks, followed by MAG212 CYBER’s extra checks for the persistence files listed in its indicators.

grep -qs svc-telemetry ~/.ssh/authorized_keys \
  && echo "svc-telemetry key found" \
  || echo "No key found; machine not impacted"

ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist \
       ~/.config/.smt ~/.config/.smtk 2>/dev/null
ls -la "$TMPDIR"/.stk_* 2>/dev/null
launchctl list | grep -i sysmond

Any output from these means you need to respond (see Section 04). Repeat the checks for every user account on the Mac.

$files = "$HOME\.ssh\authorized_keys",
         "C:\ProgramData\ssh\administrators_authorized_keys" |
         Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) {
  "svc-telemetry key found" } else { "No key found; machine not impacted" }

Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue
Test-Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"
Test-Path "$env:USERPROFILE\.config\smt.cmd", "$env:USERPROFILE\.config\smtk"
Get-ChildItem "$env:TEMP" -Force -Filter ".stk_*" -ErrorAction SilentlyContinue

The key check comes from Cursor’s notice. The persistence checks are MAG212 CYBER examples built from the file and task names in Cursor’s indicators.¹ A scheduled task, any True or any file listed means you need to respond.

04 / RESPONDIf you find it

• 1 · Isolate the machineTake it off the network. On a work device, preserve evidence and contact your security team before changing anything.
• 2 · Remove the key, persistence and tunnelCursor publishes remediation scripts. On macOS, run remediate-macos.sh as the affected user, not root. On Windows, run remediate-windows.ps1 from PowerShell opened as Administrator. The scripts exit with an error if anything remains.¹ Download them only from Cursor’s official notice.
• 3 · Rotate credentials from a trusted deviceRotate passwords, tokens, SSH keys and cloud credentials that were reachable from the affected machine. Cursor notes that the limited environment-variable collection doesn’t rule out later credential access through the backdoor.¹
• 4 · Consider rebuildingCursor recommends assessing whether to rebuild the host.¹ A cleanup script removes what’s known. A rebuild also removes what isn’t.

05 / FOR IT TEAMSIndicators of compromise

Lookups to ifconfig.me or api.ipify.org are legitimate services. Cursor says access to them alone is not an indicator. Check the notice for the latest package and payload hashes.¹

06 / PREVENTIONMake the next extension incident smaller

REFERENCESSources

1. Security notice: malicious version of Anthropic.claude-code identified in the Cursor VS Code Extension Marketplace — Cursor, Oct 29, 2026 (updated Oct 30)
2. Anthropic: That Claude Code extension compromise… couldn’t be us — The Register
3. Malicious Claude Code extension on Cursor planted SSH backdoors — BleepingComputer, Oct 30, 2026

Methodology. Facts were checked against Cursor’s security notice and the reporting above on November 3, 2026. The persistence checks are MAG212 CYBER examples built from Cursor’s published indicators and were not run against an infected host. No malware was executed for this article. Disclosure: this article was prepared with help from Claude, an AI assistant made by Anthropic, whose extension is the subject of this incident.