Claude Code Extension Backdoor in Cursor: Check, Clean Up, Rotate Keys
Identify exposure to the modified Claude Code extension distributed through Cursor's marketplace. Check the affected versions and installation window, inspect SSH and persistence indicators, run Cursor's cleanup scripts with the correct privileges, and address their limits. Then revoke accessible credentials and reinstall from a verified source.
Contents
If you installed Claude Code extension 2.1.312 or 2.1.313 through Cursor during the affected window, check the host before resuming work. Isolate machines with malicious indicators, remove the backdoor artifacts, and rotate accessible credentials from a trusted device. Updating the extension alone does not remove its persistence.
Am I affected? Check the source, version, platform, and time
Investigate if your installation matches the scope below, or if you find an indicator regardless of installation time. As of 2026-11-02, Cursor’s security notice identifies this scope:
| Check | Reported scope |
|---|---|
| Extension | Anthropic.claude-code, distributed through the Cursor VS Code Extension Marketplace |
| Versions | Modified copies of 2.1.312 and 2.1.313 |
| Platforms | macOS and Windows |
| Installation or update window | Approximately 02:27–13:35 PDT on 2026-10-29 |
| Same window in UTC | Approximately 09:27–20:35 UTC on 2026-10-29 |
Cursor says these modified packages were not developed by Anthropic. Include automatic updates in your review. A version now installed may differ from the version present during the incident.
Keep a suspected Cursor installation closed. Use existing installation records or inspect its on-disk extension metadata, including package.json, without loading the extension. Record the version, platform, source, and installation time.
Do not use claude --version as the extension check. Anthropic’s documentation explains that the extension bundles its own CLI; your terminal may run a separate installation.
Microsoft’s independent analysis confirms that Microsoft Visual Studio Marketplace and npm distributions were unaffected by this incident. A version label alone cannot distinguish an authentic package from a modified copy.
Linux requires a separate judgment. Phorion’s analysis identifies Linux code paths, but Cursor’s confirmed distribution scope names macOS and Windows. Investigate matching Linux artifacts; do not assume a confirmed Linux rollout or run a macOS cleanup script there.
Run the official SSH-key checks
Run the check for the affected account, then interpret it alongside installation and persistence evidence. The recognizable positive output is svc-telemetry key found.
These are Cursor’s published commands. Their negative message is not proof that the host was never affected.
macOS: Bash
Run this in a terminal as the affected user:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"The command checks one comment in one file. Its -s option also suppresses missing-file and read-error messages. Investigate an unreadable file instead of treating the displayed negative result as clearance.
Windows: PowerShell
Run Cursor’s check against the affected user’s profile:
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }Resolve access errors when checking the shared administrator file. If elevation uses a different account, $HOME changes; ensure the original affected profile is also checked.
A positive marker warrants containment and key verification. Cursor publishes this attacker authorization-key fingerprint:
SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
On macOS, this read-only OpenSSH fingerprint command can help compare entries:
ssh-keygen -lf "$HOME/.ssh/authorized_keys" -E sha256Compare key material with the advisory if parsing fails or comments differ. The cleanup scripts account for a malicious key appended onto an existing line. Do not delete an entire matching line blindly, because it may also contain a legitimate key.
Check persistence and preserve evidence
Check the files and startup actions below before declaring the machine clean. They are indicators to investigate, not a list of names to delete indiscriminately.
| Area | Indicators from Cursor’s notice |
|---|---|
| macOS files | ~/.config/.smt, ~/.config/.smtk, ~/Library/LaunchAgents/com.apple.sysmond.plist |
| macOS startup | LaunchAgent label com.apple.sysmond |
| Windows files | %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk |
| Windows startup | Scheduled task SysMon; fallback %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd |
| Temporary files | $TMPDIR/.stk_<10 hex> on macOS; %TEMP%\.stk_<10 hex> on Windows |
| Network | Connections to 134[.]209[.]82[.]225, including SSH on TCP 22 and HTTP /beacon on port 8099 |
The <10 hex> suffix describes a filename pattern, not literal angle brackets. Inspect a startup object’s configured action and associated files before removing it.
For team machines, preserve the extension package, relevant key files, startup configuration, and endpoint logs through your incident-response process. Isolate hosts showing payload execution or backdoor installation. Closing the editor alone does not remove detached scripts.
Phorion found that the injected code executes when Node loads the module, before the extension’s normal activate callback. You do not need to send a Claude prompt for that code to execute.
Cursor reports that the attacker’s server was taken offline. That interrupts the reported connection path but does not remove local artifacts. Likewise, failure to enable SSH does not mean the key, persistence files, or host-information collection never occurred.
Run Cursor’s cleanup script, then verify its limits
Use the script linked from Cursor’s notice after preserving required evidence. Review the downloaded file before running it, and close editors first.
The scripts target modified extension directories, tunnel processes, dropped files, persistence, and the attacker’s authorization key. Revoke API credentials separately, and review host activity beyond the script’s cleanup results.
macOS cleanup
Download Cursor’s macOS remediation script. Run it from its saved folder as each affected user, without sudo:
bash remediate-macos.sh
echo "Exit status: $?"The script rejects root execution. It targets the com.apple.sysmond LaunchAgent, matching processes and files, and extension bundles containing svc-telemetry. It removes the exact attacker key text.
Windows cleanup
Download Cursor’s Windows remediation script. Open PowerShell with Run as Administrator, then run this from the saved folder:
powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1
$LASTEXITCODEThe script visits registered user profiles. It targets the malicious task action, matching processes, extension directories, dropped files, and user-profile authorization keys.
After cleanup, separately recheck C:\ProgramData\ssh\administrators_authorized_keys where it exists. If the attacker key is present, have an administrator remove the exact unauthorized entry while preserving legitimate keys.
A nonzero exit or an incomplete message requires follow-up. Resolve reported failures and rerun the relevant check.
Exit 0 means the script did not report a remaining condition it checks. Check any custom extension locations against the published indicators. Review the local SSH service configuration separately and confirm that it matches your intended setup.
Keep the host isolated if artifacts return, unexpected SSH access appears, or you cannot account for subsequent activity. Have incident responders assess a rebuild before returning credentials to it.
Rotate credentials accessible from the affected host
Revoke exposed credentials from a trusted device, including credentials unrelated to Claude Code. Do not place replacements on the affected machine until cleanup or rebuilding is complete.
Cursor describes collection of environment-variable names. That does not establish theft of their values. Its rotation recommendation also accounts for possible later access through the backdoor.
Use this inventory to assign an owner and record completion:
| Credential | Required action |
|---|---|
| Anthropic API keys | In Claude Console’s API keys page, select the affected key’s menu, choose Delete API key, then create a replacement. |
| OpenAI API keys | Delete affected keys through the API-key dashboard, create replacements, and review usage for unexpected activity. |
| Git-host tokens | Revoke personal access tokens and other accessible credentials at their issuer. Update legitimate automation with replacements. |
| SSH client keys | Replace potentially exposed private keys and remove their old public-key authorizations from Git hosts and other servers. |
| Cloud credentials | Revoke exposed access keys and address temporary sessions separately. Review unauthorized resources, access changes, and usage. |
| Account sessions | Revoke affected browser, CLI, and SSO sessions through the relevant service or identity administrator. |
Anthropic’s compromised-key instructions document the deletion and replacement controls. OpenAI’s security guidance covers API-key deletion and usage review.
On GitHub, use personal access token settings to delete affected tokens. Separately review SSH keys and active sessions.
For AWS, follow the exposed-access-key response. Use the separate temporary-credential guidance for role sessions.
Include gateway keys in the same inventory. If you used BetterToken, include your BetterToken API key. Its console provides key creation; a replacement alone does not revoke the exposed credential. Confirm revocation with the issuer before marking rotation complete.
Removing svc-telemetry from your workstation does not revoke your own SSH private keys on remote services. Deleting a local configuration value also does not invalidate the original API key.
For broader recovery, use the credential revocation and auditing checklist. Verify issuer-side revocation, update legitimate consumers, and confirm expected requests succeed from a trusted environment.
Reinstall from a verified source after recovery
Install a current trusted release after cleanup, or on a rebuilt host. Cursor’s incident announcement asked customers to update to 2.1.314; that is the incident’s named update target.
Use Anthropic’s installation page to reach the intended extension listing. Confirm the publisher, Anthropic.claude-code identifier, source registry, and installed version. The Extensions view shows the extension version after installation.
Recheck the published indicators after login or restart. If persistence returns, stop using the host and reopen the investigation.
A terminal-only installation is a separate package path. The Claude Code installation and first-run guide helps verify that installation, but it does not clean an already affected workstation.
Verify extension provenance before the next install
Check the vendor’s installation link and the actual registry before accepting a familiar extension name. Record the publisher, identifier, version, platform, and download source for approved packages.
Cursor’s extension documentation warns that identical publisher.extension names can refer to different publishers or code across registries.
When comparing hashes, match the artifact, platform, and version. A VSIX package hash cannot be compared with an extension.js hash. A mismatch with one known malicious hash does not establish authenticity.
As of 2026-11-02, Cursor documents Marketplace Install Cooldown (hours) for team owners and admins. Enterprise teams can also require valid Open VSX extension signatures before installation.
Apply these controls alongside review of agent instructions and downloaded configuration. The AGENTS.md and Claude Code configuration audit covers that separate source of executable instructions.
