Cursor confirms a tampered Claude Code extension tried to open an SSH backdoor
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
Cursor took out of its store a doctored copy of the plugin that brings Claude Code into the editor, available for about eleven hours on October 29 and downloadable by 5,000 users at most. The code gathered data from computers and tried to leave a remote access door for the attacker. After reopening its store, it cautions that deleting the plugin might still leave the machine infected.
Cursor, the programming editor with an AI assistant, has published a security notice about a doctored copy of the Claude Code extension, Anthropic's tool for programming, which its store offered on October 29. It corresponded to version 2.1.313 and was in circulation between 2:27 a.m. and 1:35 p.m. Pacific time, that is, about eleven hours. At most 5,000 people could have installed it. Cursor stresses that Anthropic is not its author.
According to the notice, the harmful code collected information from the computer (the machine and user names, operating system, names of environment variables, the Git email and the public IP) and tried to set up a permanent way in: add an SSH key, a remote access system, controlled by the attacker, switch on the local SSH service and open a reverse tunnel to the attacker's server. To keep it going, it left scripts that retried the connection roughly every 60 seconds, through a LaunchAgent on macOS or a scheduled task on Windows.
Switching on SSH needs administrator privileges and, on most Macs and Windows PCs, the extension does not have them, so that stage fails and the attacker could not have connected. Even so, the key was added, the persistence installed and the computer's data went out to the attacker. Cursor got the cloud provider hosting that server to shut it down, so the tunnel and the data transfer no longer work. It says it has no sign that other versions of the extension or its official channel are affected.
As soon as it detected the version, Cursor pulled it and blocked its distribution; as a precaution, it then closed the whole store, checked that no other extension had been touched, changed its keys and opened it again. It asks anyone who installed or updated the extension in that window to check whether their computer holds an SSH key labeled svc-telemetry and, if so, isolate the machine, delete the key, persistence and tunnels with the scripts it supplies, and change the credentials reachable from it, using a trusted system. It cautions that uninstalling the extension may not be sufficient, because it leaves independent scripts running. According to Infobae, Anthropic released version 2.1.314 on October 30 on Open VSX and on Microsoft's marketplace.
Why it matters · analysis and opinion
The episode is a reminder that an extensions store is an entry point just like an email attachment: a well-known maker's name on the listing does not guarantee that what you installed is theirs. Anyone who programs with editors like this one, or manages a team that does, should check right away for the key named in the notice and, if it shows up, treat the computer as compromised rather than just uninstalling. What sits inside a development machine matters too: repositories, cloud keys and variables holding secrets. It is wise to keep those credentials in a manager and not in the editor's environment. What has been published does not explain how the altered version reached the store.
Official source: Cursor · Written with the help of AI: how we make the news
What does it mean for your business? · analysis and opinion
This affects development teams, freelancers and small software companies in Spain and Latin America that work with Cursor and have the Claude Code extension installed, especially if they installed or updated it on October 29 between 2:27 and 13:35, Pacific time. With automatic updates turned on, the version could have arrived without anyone requesting it. According to Cursor, there is no evidence that other versions of the extension or Anthropic's official distribution were affected.
The practical step is to update to 2.1.314 and check the SSH authorized keys file for a key labeled "svc-telemetry", using the commands Cursor has published for macOS and Windows. If it appears, the company recommends isolating the computer, deleting the key and the scheduled tasks it leaves installed, and changing, from another trusted computer, the credentials that computer had access to. Removing the extension is not enough, because it leaves scripts that keep running.
The risk is not only remote access, which failed on most computers due to lack of administrator permissions: the data sent, such as the Git email or the names of environment variables, gives clues about which cloud services and which credentials each computer uses. Our advice is to review which extensions update themselves on computers with access to clients or servers, and to grant administrator permissions only to those who truly need them.
