Did the trojanised Claude Code extension 2.1.313 reach your machines?
Anthropic.claude-code 2.1.313 was a malicious copy of the Claude Code extension, not built by Anthropic, served by Cursor's VS Code extension marketplace between about 09:27 and 20:35 GMT on 29 October 2026. It adds an attacker SSH key labelled svc-telemetry, installs persistence and sends host details out. Update to 2.1.314 or later, then check every machine for the key.
No CVE: a marketplace supply-chain compromise
There is no CVE or CVSS score because no product flaw was exploited. A malicious package was served through Cursor's marketplace. CybaVerse rates it Critical. Cursor says at most 5,000 users were affected and it will contact them directly. Removing the extension alone does not remove the backdoor.
By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 30 October 2026, 11:35 GMT.
At a Glance
Based on Cursor's security notice and public reporting as of 30 October 2026. Last updated 30 October 2026, 11:35 GMT.
Critical (CybaVerse rating)
No CVE or CVSS score. A supply-chain compromise that plants an SSH key and persistence.
Removed, server offline
Cursor pulled the version, rebuilt its marketplace and rotated its keys. The attacker server is offline.
At most 5,000 users
Anyone who installed or auto-updated to 2.1.313 from Cursor's marketplace on 29 October.
2.1.314 or later, then clean up
Update the extension, then remove the key, persistence and tunnel. Updating alone is not enough.
The malicious Anthropic.claude-code 2.1.313 becomes available in Cursor's VS Code extension marketplace.
The exposure window ends. Cursor removes the version, shuts the marketplace down and has the attacker server taken offline.
Cursor rotates its keys, rebuilds the marketplace, confirms no other extensions were tampered with and publishes its notice.
2.1.314 is available on Open VSX and the VS Code Marketplace. Public reporting says no follow-on payloads have been seen.
What the malicious extension does
- Collects host details: hostname, username, OS and architecture, home and working directories, the global Git email, the public IP and environment variable names (Cursor). Public reporting adds that it takes up to 40 names matching KEY, TOKEN, SECRET, PASS, AWS or GCP, and not their values.
- Plants a backdoor: adds an attacker SSH key labelled svc-telemetry to
~/.ssh/authorized_keys, tries to enable the local SSH service and opens a reverse SSH tunnel to 134.209.82.225. - Persists (per Cursor): on macOS, the LaunchAgent
com.apple.sysmondwith~/.config/.smtand.smtk. On Windows, the scheduled taskSysMon(trying to run as SYSTEM) withsmt.cmdand a Startup fallbacksysmon.cmd. Background scripts retry the tunnel about every 60 seconds. A Linux crontab is reported in the news only. Cursor does not list one. - Beacons: sends host details and backdoor status by HTTP POST to 134.209.82.225:8099/beacon.
Cursor says the tunnel step would fail for two reasons: enabling SSH needs admin rights, which the extension does not have on most macOS and Windows hosts, and bugs in the malicious code break it unless Cursor was started as an administrator. Where it failed, the attacker could not log in. The key, the persistence and the beacon still ran, so every affected machine needs cleaning.
What to Do in the Next 24 Hours
Proactive on the left. Reactive on the right. Tick both tracks.
Find, update and lock down
- Find every Cursor or VS Code user with Claude Code 2.1.313, especially anyone who updated on 29 Oct.
- Update the extension to 2.1.314 or later.
- Block 134.209.82.225 at the firewall and web proxy.
- Allow-list editor extensions and turn off auto-update for AI coding extensions on managed devices.
Hunt and contain
- Search authorized_keys (and administrators_authorized_keys on Windows) for svc-telemetry.
- Look for the SysMon task, the com.apple.sysmond LaunchAgent and .smt files, or crontab entries (news reports only).
- Check for connections to 134.209.82.225 on ports 22 and 8099, and for ssh or autossh tunnels.
- If found, isolate, keep evidence, clean up with Cursor's macOS or Windows script and rotate credentials from a trusted machine.
Proactive: Find Exposure and Lock Down
Work out which machines received 2.1.313, update them and stop extensions arriving unchecked again.
Find every machine with 2.1.313
Search your EDR, RMM or software inventory for an anthropic.claude-code-2.1.313 folder under .cursor/extensions or .vscode/extensions in each user profile. Prioritise anyone who installed or updated extensions on 29 October, including contractors and build machines.
Update to 2.1.314 or later
Update the Claude Code extension to 2.1.314 or later, available on Open VSX and the VS Code Marketplace. 2.1.313 came only from Cursor's marketplace. Open VSX never served it. Then carry on with the hunts below, because updating does not remove the backdoor.
Block 134.209.82.225
Block 134.209.82.225 on all ports at the firewall, web proxy and EDR network controls, and alert on any attempt to reach it. The server is offline, but persistence on an affected machine keeps retrying.
Allow-list extensions and stop silent updates
On managed devices, use your editor's policy or settings to allow only approved extensions, and turn off auto-update for AI coding extensions so new versions are reviewed before they land.
// settings.json on managed devices
"extensions.autoUpdate": false,
"extensions.autoCheckUpdates": falseReview outbound SSH
Few laptops need outbound SSH to the internet. Review and restrict outbound TCP 22 from user devices to known hosts, and alert on new outbound SSH from workstations.
Treat developer machines as high value
Developer machines hold cloud keys, tokens and source code. Keep them in EDR, keep their logs, and prefer short-lived credentials over long-lived keys in environment variables.
Free Detection Pack
Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Everything is read-only.
check-claude-code-ext.sh
Looks for 2.1.313 in Cursor, VS Code and other VS Code-based editor folders, scans extension.js for the indicators, and checks authorized_keys, the payload files, LaunchAgents, crontabs, temp files and running ssh or autossh tunnels.
bash check-claude-code-ext.sh # current user
sudo bash check-claude-code-ext.sh --all-users # every home, plus /rootCheck-ClaudeCodeExt.ps1
The same checks in PowerShell 5.1 or 7, plus administrators_authorized_keys, the SysMon scheduled task and the Startup folder. Run elevated with -AllUsers to cover every profile.
powershell -ExecutionPolicy Bypass -File .\Check-ClaudeCodeExt.ps1 # current user
powershell -ExecutionPolicy Bypass -File .\Check-ClaudeCodeExt.ps1 -AllUsers # elevated, every profileKQL hunts and Sigma rules
9 KQL queries for Microsoft Sentinel and Defender XDR covering connections to the attacker IP, the beacon, reverse SSH tunnels, authorized_keys changes, persistence and extension inventory. 8 Sigma rules cover the same ground for other SIEM platforms.
Verdicts
- CLEANNo 2.1.313 install and none of the indicators found in the locations checked.
- INDICATORS FOUND2.1.313 is present, or the svc-telemetry key, a payload file, persistence or a tunnel to the attacker IP was found.
- UNKNOWNA location could not be read. Re-run as root or elevated.
Exit codes
| Code | Meaning |
|---|---|
| 0 | CLEAN |
| 1 | INDICATORS FOUND |
| 2 | UNKNOWN |
| 3 | Error, such as bad arguments or a missing path |
Businesses and MSPs can use the exit code in RMM or scheduled jobs to flag machines at scale.
Know the limits
- Both checkers are read-only and offline. They never connect to the attacker IP or anywhere else, never remove keys, tasks, cron entries or LaunchAgents, and never run Cursor's removal scripts.
- Linux crontab checks are based on news reports only and match on the published IP, file names and tunnel options.
- Hashed known_hosts entries are not checked.
- The KQL has not been run against a live tenant. Check the field names against your connectors before relying on an empty result.
Reactive: How to Hunt
Hunt every machine that ran 2.1.313, from 29 October onwards. CybaOps can run these hunts across your estate or your clients'.
The svc-telemetry SSH key
Search ~/.ssh/authorized_keys for every user, and C:\ProgramData\ssh\administrators_authorized_keys on Windows, for the svc-telemetry comment or its fingerprint. A match means the machine is affected.
Persistence
On macOS, look for ~/Library/LaunchAgents/com.apple.sysmond.plist and ~/.config/.smt and .smtk. On Windows, look for the SysMon scheduled task, %USERPROFILE%\.config\smt.cmd and smtk, and the Startup fallback sysmon.cmd. Also check temp folders for .stk_ files. On Linux, public reporting describes a crontab entry, so check crontabs for the attacker IP or tunnel options.
Network connections
Search firewall, proxy, DNS and EDR network logs for any connection to 134.209.82.225, especially TCP 22 (the tunnel) and TCP 8099 (the beacon), from 29 October onwards.
Tunnel processes
Look for ssh -N -R or autossh -M 0 processes with StrictHostKeyChecking=no, and for systemsetup -setremotelogin on, schtasks /create /tn SysMon or OpenSSH Server being added.
SSH turned on
Check whether Remote Login on macOS, the OpenSSH Server service on Windows or sshd on Linux was enabled on 29 October without a change request. If it was, the attacker may have been able to log in, so treat the host as compromised.
Credential use
Review sign-ins and API activity for the cloud, CI and source-control accounts used on affected machines for anything unusual since 29 October.
Indicators of compromise (from Cursor)
| Type | Indicator |
|---|---|
| Network | Attacker host 134.209.82.225. Reverse SSH as tunnel@134.209.82.225 on TCP 22. HTTP POST beacon to http://134.209.82.225:8099/beacon, plus a loopback attempt to 127.0.0.1:8099/beacon. Lookups to ifconfig.me or api.ipify.org are legitimate services and not an indicator on their own. |
| SSH key | Comment svc-telemetry. Fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk. Reverse-tunnel key fingerprint SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ. |
| macOS files | ~/.config/.smt, ~/.config/.smtk, $TMPDIR/.stk_<10 hex> and ~/Library/LaunchAgents/com.apple.sysmond.plist (label com.apple.sysmond). |
| Windows files | %USERPROFILE%\.config\smt.cmd, %USERPROFILE%\.config\smtk, %TEMP%\.stk_<10 hex>, scheduled task SysMon and the fallback Startup\sysmon.cmd in the user's Start Menu. |
| Processes | ssh -N -R '*:0:localhost:22' or autossh -M 0 with StrictHostKeyChecking=no and UserKnownHostsFile=/dev/null, schtasks /create /tn SysMon, systemsetup -setremotelogin on and Add-WindowsCapability -Online -Name OpenSSH.Server. |
| Package | extension.js in the anthropic.claude-code-2.1.313-darwin-arm64 or -win32-x64 folder containing the attacker IP and svc-telemetry. VSIX SHA-256: 432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab62 (darwin-arm64) and 3de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081 (win32-x64). |
If you find something
- Isolate the machine and preserve evidence: authorized_keys, the persistence files, process lists, and shell, EDR and network logs.
- Remove the key, persistence and tunnel processes with Cursor's removal scripts from its security notice:
remediate-macos.shas the affected user (not root) andremediate-windows.ps1from PowerShell run as Administrator. They exit non-zero if anything remains. Cursor has published no Linux script, so on Linux remove the key, any crontab entry, the files and tunnel processes by hand and record what you removed. - Uninstalling the extension is not enough, because the payload drops standalone scripts that keep running.
- Consider rebuilding the machine, especially if SSH was enabled.
- From a trusted machine, rotate the credentials and sessions reachable from the affected one: cloud keys, CI and Git tokens, SSH keys and browser sessions.
Updated does not mean clean
Version 2.1.314 removes the malicious code from the extension, but it does not remove the SSH key, the LaunchAgent or scheduled task, or a running tunnel. Every machine that ran 2.1.313 should be hunted, not just updated.
Claude Code Extension 2.1.313 FAQ
Short answers based on Cursor's security notice and public reporting as of 30 October 2026.
Am I affected?
Only if a machine installed or updated to Anthropic.claude-code 2.1.313 from Cursor's VS Code extension marketplace between about 09:27 and 20:35 GMT on 29 October 2026. Cursor says at most 5,000 users were affected and that it will contact them directly. The quickest test is to look for the svc-telemetry key in authorized_keys.
Was the extension made by Anthropic?
No. Cursor says the malicious version was not developed by Anthropic. It was a modified copy of the Claude Code extension that appeared in Cursor's marketplace. Cursor says it has no evidence that other versions or the official distribution are affected.
Is there a CVE or CVSS score?
No. This is a supply-chain compromise of a marketplace, not a flaw in a product, so there is no CVE and no CVSS score. CybaVerse rates it Critical because it plants an SSH backdoor and persistence on developer machines.
Could auto-update have installed it without anyone noticing?
Yes, that is possible. Public reporting, not Cursor, notes that anyone with the extension set to auto-update during the window could have received it without doing anything. Check every machine where Cursor or VS Code pulled extensions from Cursor's marketplace on 29 October, not only people who installed it by hand.
Did the attacker actually get into machines?
Probably not on most, but you cannot assume that. Cursor says turning on the local SSH service needs admin rights, which the extension does not have on most macOS and Windows hosts, and that bugs in the malicious code make the step fail unless Cursor was started as an administrator. Where it failed, the attacker could not log in through the tunnel. The extension still added the SSH key, installed persistence and sent host details, so follow the clean-up steps either way.
What data was taken?
Cursor says the payload collected the hostname, username, operating system, architecture, home and working directories, environment variable names, the configured Git email and the public IP. Public reporting adds that it took up to 40 variable names matching KEY, TOKEN, SECRET, PASS, AWS or GCP, without their values. Those names can still reveal which cloud and CI services you use.
Is updating to 2.1.314 enough?
No. Updating or uninstalling removes the extension, but the payload drops standalone persistence scripts that keep running. Remove the SSH key, the persistence and any tunnel process with Cursor's removal scripts (remediate-macos.sh, or remediate-windows.ps1 run as Administrator), then rotate credentials. There is no Cursor script for Linux, so clean Linux machines by hand.
Is the attacker's server still live?
No. Cursor says it worked with the hosting provider to take the server offline, so the reverse tunnel and beacon no longer work. Public reporting says no follow-on payloads have been seen. Block the IP anyway, as persistence on an affected host keeps retrying about every 60 seconds.
Were other extensions or Open VSX affected?
Cursor says it audited access and confirmed no other extensions were tampered with. 2.1.313 was served only by Cursor's marketplace. Open VSX never served it, and the fixed 2.1.314 is on both Open VSX and the VS Code Marketplace. It removed the version, shut the marketplace down, rotated its keys, rebuilt the marketplace and brought it back online.
We are an MSP or manage many developer machines. Where do we start?
Use your RMM or EDR to list every device with anthropic.claude-code 2.1.313 in its Cursor or VS Code extensions folder and every device with svc-telemetry in authorized_keys. Block the attacker IP across all client firewalls, then isolate and clean any device where the key or persistence is found.
Protect Your Developers, and Your Clients'
CybaOps monitors your endpoints, servers and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.
Sources
- Cursor: Security notice, malicious version of Anthropic.claude-code (2.1.313) in the Cursor Extension Marketplace
- The Hacker News: Official Claude Code VS Code extension compromised to install persistent SSH backdoor
Related threat guides: Brotli HTTP2Shell and Magento PolyShell. All threat guides.