Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

Installed Claude Code in Cursor on October 29? Check your machine for this backdoor

Ship ItChecked against the official source

Source checked 31 Oct 2026 · Published 31 Oct 2026 · Last reviewed 31 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

Cursor's security notice says that between about 2:27am PT and 1:35pm PT on October 29, 2026, a maliciously modified version of Anthropic's Claude Code extension was made available in the Cursor VS Code Extension Marketplace. The affected packages are Anthropic.claude-code 2.1.312 and 2.1.313, installed on macOS or Windows from Cursor's marketplace. The extension attempts to install a persistent SSH backdoor and reports host and user information. Cursor says it has no evidence that other versions of the extension or the official distribution are affected.

What to do

  1. Check whether you installed or updated the Claude Code extension in Cursor on October 29, 2026, on macOS or Windows.
  2. Run the check in Cursor's notice. It looks for the attacker's public key, labeled svc-telemetry, in your SSH authorized keys.
  3. If the key is found, your machine is impacted. Uninstalling the extension may not be sufficient: run Cursor's remediation script for your platform.
  4. Rotate credentials and sessions accessible from that machine, from a trusted system.

Good to know

  • Cursor says the attacker server no longer functions, but recommends following the remediation steps regardless.

Source

Checked on 31 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.