Claude Code in Cursor: how to check for the malicious extension and remove the backdoor

Who is actually at risk

Cursor’s official notice identifies malicious version Anthropic.claude-code 2.1.313, available in the Cursor Extension Marketplace from approximately 02:27 to 13:35 Pacific time on October 29, 2026. The company estimates an upper bound of 5,000 affected users. Microsoft’s technical analysis also mentions 2.1.312, so a prudent step is to check both versions if they came through Cursor during this period.

According to Microsoft, neither the official Visual Studio Marketplace nor the npm package @anthropic-ai/claude-code distributed modified packages. Anthropic told Microsoft that its systems were not compromised. This distinction matters: the incident does not mean every Claude Code installation is infected.

A two-minute check

Cursor identifies an unauthorized key with the comment as the simplest indicator: svc-telemetry. On macOS, open Terminal and run the official command:

grep -qs svc-telemetry ~/.ssh/authorized_keys \
  && echo "svc-telemetry key found" \
  || echo "No key found"

On Windows, open PowerShell and check two standard files:

$files = "$HOME\.ssh\authorized_keys", `
  "C:\ProgramData\ssh\administrators_authorized_keys" |
  Where-Object { Test-Path $_ }

if ($files -and (Select-String svc-telemetry $files)) {
  "svc-telemetry key found"
} else {
  "No key found"
}

The absence of this string is a useful signal, not a universal guarantee that the machine is clean. For an organization’s computer, review extension installation logs, SSH processes, startup mechanisms and the network indicators on Cursor’s page. Do not paste discovered secrets or full logs into a public chat.

If svc-telemetry is found

1. Disconnect the computer from the network. Stop using repositories, cloud services and banking on that machine.
2. Open Cursor’s official notice from a trusted device. Download the remediation script only from the link in that notice, not from a random copy or post.
3. Run the script according to the platform instructions. Cursor says to run the macOS script as the affected user and the Windows script in PowerShell with administrator privileges.
4. Repeat the check. The official scripts should exit with a nonzero code if anything remains. In a workplace, preserve evidence before cleanup according to your team’s policy.
5. Consider a complete reinstall. For a machine with production access, client data or a confirmed tunnel, a clean rebuild may be more reliable than manual cleanup.

Cursor says the attacker’s server has been shut down and that bugs in the code prevented remote SSH access on most macOS and Windows machines unless Cursor was run with administrator privileges. This reduces the risk, but does not undo the installed key, persistence mechanisms or host information already sent.

What to rotate and in what order

Microsoft confirmed that the initial report transmitted environment variable names, not their values. A successful backdoor could nevertheless have provided broader access. After isolating the affected machine, rotate credentials from a trusted device:

• active GitHub and GitLab sessions, cloud dashboards and email sessions;
• SSH keys and deploy keys available to the user;
• API tokens for OpenAI, Anthropic, Google and other services;
• database, hosting, package registry and CI/CD keys;
• passwords or tokens that may have been in local configuration files or credential managers.

Creating a new key is not enough: revoke the old one, update dependent services and review spending and request logs. Our separate guide explains how to store API keys in a vibe-coding project.

How to reduce the risk with future updates

Cursor recommends treating extensions like dependencies: check their publisher and identifier, restrict allowed extensions and delay automatic updates. Teams can use install cooldowns, allowlists and signature verification. None guarantees safety, but a delay of a few hours might have kept users outside this attack’s short window.

• Do not run the editor with administrator privileges without a specific reason.
• Keep production secrets off your everyday machine, or at least in a profile with minimal privileges.
• Start an AI agent with read-only access and a separate test environment; use our safe-access map.
• Record the source and version of important extensions so you do not have to guess during an incident.

What is known and what is not