Tampered Claude Code add-on on Cursor planted a backdoor

Many people update add-ons in their code editor without a second thought, because the name and the developer are familiar. But on 29 October 2026, an update like that on Cursor could have opened a way for attackers to reach your machine.

Cursor, a code editor with built-in AI, said versions 2.1.312 and 2.1.313 of the Claude Code add-on for Windows and macOS on its own store had been tampered with, and that Anthropic did not develop them. The versions were on the store for about 11 hours, from 16:27 on 29 October to 03:35 on 30 October, Thai time.

Help Net Security reported that Cursor said at most 5,000 users were affected. If you are one of them, removing the add-on may not be enough.

The code ran as soon as the add-on loaded

You did not even have to ask Claude Code to do anything.

BleepingComputer reported that the attackers put code at the start of the add-on's main file and left the rest unchanged. When the add-on loaded, the code ran by itself and sent out machine details such as the username, machine name, public IP address, Git email and the names of variables that looked like they held secrets. Help Net Security said it sent only the names, not the values inside.

It then added the attacker's SSH key to the machine. SSH is the channel used to control a computer remotely. Put simply, the attacker quietly cut a copy of your house key, then kept trying to open a tunnel back to their own server about every 60 seconds.

The way in broke on many machines, but you should still check

The attackers' own code had mistakes in it.

Cursor said turning on SSH would usually fail without admin rights. BleepingComputer explained that on macOS the code's check of the Remote Login setting failed, so it skipped that step, and on Windows it ran the command through /bin/sh, which standard Windows installs do not have.

But the key and scripts could still be installed, and machine details were still sent out. Help Net Security said that if a Mac already had SSH on, or the user turned it on later, the way in worked. Cursor worked with the hosting provider to take the attacker's server offline, and still advises cleaning the machine.

Check your machine with these 4 steps

Every step comes from Cursor's notice, except the version number in step 4, which comes from StepSecurity.

1. Check for the key: on a Mac, open Terminal and run grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted". On Windows, use the PowerShell command in Cursor's notice.
2. If it says svc-telemetry key found, the machine is affected: take it off the network and run Cursor's clean-up script, which removes the add-on, the planted scripts and the attacker's key. Then decide whether to rebuild the machine.
3. Change your credentials: from another machine you trust, change the passwords, tokens and sessions that machine could reach.
4. Update the add-on: use version 2.1.314 or later, which replaces the affected versions.

Nobody has said how the attackers got in

Anthropic's own release was not altered, according to what is known so far.

StepSecurity reported that Anthropic said its systems, staff laptops and official channels were not compromised, and that version 2.1.313 was never on Open VSX or the Microsoft Marketplace. The company skipped straight to 2.1.314.

Cursor took its whole add-on store offline for a time, audited access, changed its keys and found no other tampered add-ons. But BleepingComputer said there is still no explanation of how the attackers published these versions under Anthropic's name, or whether either company's systems were breached.

If you use Cursor, run the check now and don't wait for an email

Help Net Security reported that Cursor plans to contact affected users directly, but the check takes less than a minute. If you had Cursor open on 29 or 30 October, run it today. The case is also a reminder that a developer's name on a store does not always prove a file is genuine.

FAQ

I use Claude Code in Terminal or VS Code. Should I worry?

Cursor found no evidence that other versions or the official distribution were affected, and BleepingComputer reported that Cursor was the only source of these versions. The people who should check are those who installed or updated through Cursor during that window.

Does removing the add-on fix it?

It may not. Cursor warned that separately installed scripts can keep running, so run the check, and use the clean-up script if the key is there.

Has my password been stolen?

BleepingComputer reported that the code did not directly steal credentials, but Cursor warned that collecting limited variable data does not rule out later access to credentials through the planted way in. If you find the key, change your credentials.

Sources

• Cursor: Security notice, malicious version of Anthropic.claude-code
• BleepingComputer: Malicious Claude Code extension on Cursor planted SSH backdoors
• Help Net Security: Claude Code extension poisoned with persistent SSH backdoor
• StepSecurity: Trojanized Claude Code extension delivered persistent SSH backdoor to developer machines