Picked
Fake Claude Code extension in Cursor left a back door
- Why it matters
- For about 11 hours on October 29, Cursor's extension store offered a tampered Claude Code extension (versions 2.1.312 and 2.1.313). It quietly added an attacker's key so they could get back into the computer later.
- What we're doing
- We're checking the computers we manage for Cursor and the affected versions. If your team uses Cursor on a computer we don't manage, we can check it for you.
- What you should do
- If anyone on your team uses Cursor, update the Claude Code extension and check the computer for SSH keys and startup items you don't recognize. Removing the extension alone doesn't remove the back door.
What's going on
Cursor is an AI code editor, and for about 11 hours on October 29 its extension store offered a tampered copy of the Claude Code extension. Anyone who installed or updated the extension in that window got version 2.1.312 or 2.1.313, which quietly added an attacker's key to the list of keys allowed to sign in to the computer remotely. That key stays even after the extension is updated or removed, so it's the computer that needs checking, not just the extension. If no one on your team uses Cursor, this doesn't affect you.
How to check
- Ask your team whether anyone uses Cursor, the AI code editor. If no one does, you're done.
- On each computer that has Cursor, open it and go to the Extensions panel (the squares icon on the left side).
- Find Claude Code in the list of installed extensions and look at its version number.
- If it's 2.1.312 or 2.1.313, or you know it was installed or updated on October 29, treat that computer as affected.
What to do if a computer is affected
- Update the Claude Code extension in Cursor to the latest version.
- Don't stop there: the back door is a separate key added to the computer, so updating or removing the extension doesn't take it away.
- Have your IT provider check the computer's SSH keys (the keys allowed to sign in remotely) and its startup items, and remove anything they don't recognize.
- If they find something, ask them to change the passwords and access keys used on that computer, since someone else may have had access.
- Tell anyone else who uses Cursor for your business, including contractors, to run the same check.
Deeper dive: check from the command line
Optional, for readers comfortable with a command line. These commands only read information; they don't change, install or delete anything. Run them only on computers and websites you own or are responsible for. Results depend on how a computer is set up, so a clean result isn't a guarantee. If something looks wrong, or you're not sure what you're seeing, stop and call your IT provider. Provided as-is, for information.
Mac or Linux (Terminal): which Claude Code extension versions Cursor has
ls ~/.cursor/extensions | grep -i claude-codeWhat you should see: Folder names that include the version, such as anthropic.claude-code-2.1.314. A folder with 2.1.312 or 2.1.313 means that computer needs the checks below. "No such file" means Cursor isn't installed for this user.
Windows (PowerShell): which Claude Code extension versions Cursor has
Get-ChildItem "$env:USERPROFILE\.cursor\extensions" -ErrorAction SilentlyContinue | Where-Object Name -match 'claude-code' | Select-Object NameWhat you should see: Folder names that include the version. 2.1.312 or 2.1.313 means that computer needs the checks below. No output means Cursor or the extension isn't installed for this user.
Mac or Linux (Terminal): look for the attacker's key
grep -n "svc-telemetry" ~/.ssh/authorized_keysWhat you should see: No output is what you want. A matching line is the key the tampered extension added: stop and call your IT provider. "No such file" is also fine.
Windows (PowerShell): look for the attacker's key
Select-String -Path "$env:USERPROFILE\.ssh\authorized_keys","$env:ProgramData\ssh\administrators_authorized_keys" -Pattern "svc-telemetry" -ErrorAction SilentlyContinueWhat you should see: No output is what you want. Any result is the attacker's key: stop and call your IT provider.
Mac (Terminal): programs set to start when you sign in
ls -lt ~/Library/LaunchAgentsWhat you should see: A list, newest first. Anything dated October 29 or later that you don't recognize is worth showing your IT provider.
Windows (PowerShell): scheduled tasks created since October 29
Get-ScheduledTask | Where-Object Date -ge '2026-10-29' | Select-Object TaskName, TaskPath, DateWhat you should see: Tasks created on or after October 29. Software updates add some; anything you don't recognize is worth showing your IT provider.
Linux (terminal): scheduled jobs for your account
crontab -lWhat you should see: "no crontab" or only jobs you recognize. Anything unfamiliar is worth showing your IT provider.
Mac or Linux (Terminal): any connection to the attacker's server
netstat -an | grep 134.209.82.225What you should see: No output is what you want. A line means the computer is talking to the server named in the reports: disconnect it from the network and call your IT provider.
Windows (Command Prompt or PowerShell): any connection to the attacker's server
netstat -an | findstr 134.209.82.225What you should see: No output is what you want. A line means the computer is talking to the server named in the reports: disconnect it from the network and call your IT provider.