Claude Code Extension Backdoor: How to Check If Cursor Gave You the Bad Build

The Claude Code extension backdoor is real, but it only hit a narrow slice of people: those whose Cursor editor pulled a tampered copy of Anthropic’s extension on October 29. If you installed or updated Claude Code in Cursor that day, check your machine now, because removing the extension alone does not remove the backdoor.

Anthropic says its own channels were never affected. The bad builds came through Cursor’s marketplace only.

Here are the facts that matter most:

• Affected: anthropic.claude-code versions 2.1.312 and 2.1.313, but only the copies served by Cursor’s marketplace.
• Window: roughly 11 hours on October 29 (UTC), with up to 5,000 Cursor users exposed.
• Safe version: 2.1.314 or later.
• What it does: adds an attacker’s SSH key to your machine and opens a reverse tunnel back to the attacker.

If you only use Claude Code in a terminal, or installed the extension from another source, this particular incident is unlikely to touch you.

What happened with the Claude Code extension backdoor

According to StepSecurity’s analysis, trojanized builds of the Claude Code VS Code extension appeared in Cursor’s marketplace around 09:27 UTC on October 29. Cursor pulled the versions and took its marketplace offline at about 20:35 UTC the same day, then rotated keys.

Anthropic told researchers it never built or published version 2.1.313, and that the clean release that followed was numbered 2.1.314. Clean copies of 2.1.312 and 2.1.314 sit on Open VSX, so the poisoned files were specific to Cursor’s marketplace.

Other outlets, including heise, reported the same incident. The command-and-control server has since been taken offline with its host’s help, per StepSecurity. We don’t yet know how the attacker got the tampered files into the marketplace.

If you’ve been following AppAuxin’s coverage of AI-tool security, this lands in the same neighborhood as our look at fake ChatGPT and Claude installers. The difference here is that the file looked official, and it came from a store you’d normally trust.

What the backdoor does once it runs

When the extension loads, StepSecurity says the malicious code runs under plain Node.js and does four things in sequence:

• Adds an attacker SSH key, labeled svc-telemetry, to your authorized_keys file.
• Drops a second key and opens a reverse SSH tunnel to a server at 134.209.82.225.
• Installs persistence for your operating system so it survives a reboot.
• Sends a system report over plain HTTP, including the names of environment variables that contain words like KEY, TOKEN, SECRET, PASS, AWS or GCP.

The reverse tunnel is the serious part. It gives the attacker a way to reach your machine’s SSH port from outside, even behind a home router. The variable-name report tells them where your cloud and code-hosting credentials probably live.

How to check if you’re affected

Start with the first row, since the SSH key is the most reliable sign. On macOS or Linux, run grep svc-telemetry ~/.ssh/authorized_keys. On Windows, search the same file in your user folder.

You can also look in your Cursor extensions folder (usually ~/.cursor/extensions) for a folder starting with anthropic.claude-code-2.1.312 or anthropic.claude-code-2.1.313. Finding one means you ran an affected version at some point, though it doesn’t prove you were compromised. A clean result on every row above is good news, but one missing sign doesn’t fully clear a machine that ran the bad build.

What to do if you find a match

Treat the machine as compromised, and work from a different, clean computer for the first steps. StepSecurity’s advice, runs in this order:

• Save evidence, such as the LaunchAgent, task or cron entry, before you delete anything.
• Remove the persistence and the attacker’s key, then remove the extension and install 2.1.314 or later. Cursor also published remediation scripts for macOS and Windows.
• Rotate every credential the machine could reach: Git hosting tokens, cloud keys, SSH keys, CI secrets and package registry tokens.
• Check your SSH, shell and login logs for activity you don’t recognize.

If logs show the tunnel actually connected, StepSecurity recommends rebuilding the machine rather than trying to clean it. That’s inconvenient, but it’s the only way to be sure.

Credential rotation is the step people skip. Our piece on dormant AI agents holding live credentials explains why old tokens are worth cleaning up even when nothing has gone wrong.

Frequently Asked Questions

Is the official Claude Code extension unsafe now?

No. Version 2.1.314 and later are the clean releases, and Anthropic says its official channels weren’t affected. Update to the latest version and you’re past this incident.

Does uninstalling the extension remove the backdoor?

No. The SSH key and the startup entries stay behind. You have to remove those separately and rotate your credentials.

Did this affect VS Code or Open VSX users?

Not according to current reports. Open VSX serves clean copies, and Anthropic says 2.1.313 was never published to Open VSX or the Microsoft marketplace.

How do I know if I installed the bad version?

Check your extensions folder for 2.1.312 or 2.1.313 and search your authorized_keys file for svc-telemetry. If you installed or updated on October 29 and see either, follow the cleanup steps above.

Should you trust marketplace extensions after this?

Yes, but with fewer assumptions. A publisher name and a version number didn’t protect anyone here, because the tampering happened between the publisher and the user. My practical advice: turn off automatic extension updates in editors where your code and keys live, and update on a delay of a day or two so the early warnings reach you first. And if you spent October 29 coding in Cursor, spend ten minutes on the checks above today.