Sunday, November 1, 2026
IT BusinessDigest
Get the Daily Brief
News

Cursor's Claude Code backdoor hit 2.1.312 too: what to check

A fake update to the Claude Code extension sat in Cursor's marketplace for about 11 hours on October 29. Most reports name one version. Cursor's own notice names two, and removing the extension leaves the backdoor in place.

Avery Lane AI and software writer · · 3 min read
A laptop screen displaying code and a steaming mug on a desk

A tampered copy of the Claude Code extension from Anthropic was live in Cursor's extension marketplace from about 2:27am to 1:35pm Pacific time on October 29. It planted an SSH backdoor on developer machines. Cursor says Anthropic did not write the malicious code, and news reports quote Cursor as saying at most 5,000 users were affected. Cursor took its whole marketplace offline, rotated its keys and rebuilt it before bringing it back. How the attackers published under Anthropic's name has not been explained.

Most coverage, and most of the checklists circulating, name one version: 2.1.313. Cursor's notice, updated at 11:30am PT on October 30 with new indicators and "clarified affected versions," lists Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS. StepSecurity describes the 2.1.312 it checked on Open VSX as clean. Brandefense found 2.1.312 and 2.1.314, but not 2.1.313, listed on Open VSX and Microsoft's marketplace, without judging 2.1.312 either way. For a team using Cursor, the safe reading is Cursor's: a machine that took either version from Cursor's marketplace during the window needs checking.

What the payload does

The loader runs as soon as the editor loads the extension, with no click from the user, and machines with auto-update could have picked it up unseen. It adds an attacker key labeled svc-telemetry to the user's SSH authorized keys, tries to switch on SSH, and opens a reverse tunnel to 134.209.82.225. A launch agent on macOS, or a scheduled task on Windows, retries the tunnel about every 60 seconds. It also sends the hostname, username, Git email, public IP and the names (not the values) of up to 40 environment variables that look like credentials, such as ones containing TOKEN, SECRET or AWS.

Turning on SSH usually fails without admin rights, Cursor says, but the key and the persistence still get installed. Phorion, which analyzed the code, warned that this is no protection: the backdoor works on any Mac where Remote Login is already on or gets turned on later. Cursor's notice is plain on the main point for IT: uninstalling the extension may not be enough, because the payload leaves scripts behind that keep running.

Reports differ on whether the build also reached Open VSX, the registry used by other VS Code-based editors such as Windsurf. BleepingComputer and The Hacker News say Cursor's marketplace was the only source, and Help Net Security and StepSecurity say Open VSX carried it too. Anthropic had published a clean 2.1.314 by October 30.

What IT teams should do

  1. List every machine running Cursor, and pull its extension list with versions. Flag any with Anthropic.claude-code 2.1.312 or 2.1.313.
  2. On each flagged Mac, look for svc-telemetry in ~/.ssh/authorized_keys, for ~/Library/LaunchAgents/com.apple.sysmond.plist, and for .smt and .smtk files in ~/.config. On Windows, check both C:\ProgramData\ssh\administrators_authorized_keys and the user's $HOME\.ssh\authorized_keys, a scheduled task named SysMon, and smt.cmd under the user's .config folder. Cursor's indicator list and StepSecurity also include a cron @reboot entry on Linux. Cursor says a machine with the key is impacted.
  3. Search network logs for traffic to 134.209.82.225 on ports 22 and 8099. Lookups to api.ipify.org on their own are normal.
  4. Isolate any hit and collect evidence before cleaning. Cursor's scripts, remediate-macos.sh (run as the user, not root) and remediate-windows.ps1 (run from an administrator PowerShell), exit with an error if anything is left. StepSecurity says a rebuild is safer than cleanup if the tunnel ever connected.
  5. From a clean machine, rotate what the developer could reach: tokens for Git hosting, CI/CD pipelines, cloud accounts and package registries, plus SSH keys.
  6. Going forward, allow-list editor extensions by publisher, ID and version, and raise an alert whenever a new SSH key, LaunchAgent or scheduled task appears, as Brandefense suggests. Cursor, VSCodium and VS Code pull from different registries, so the allow-list needs to cover each.

Our Railway breach guide has a fuller secret rotation checklist, and our LiteLLM proxy logs story covers last week's compromised LiteLLM release.

Sources: Cursor security notice, StepSecurity, BleepingComputer, The Hacker News, Help Net Security, Unite.AI, Brandefense.

Sources