Trojanized Claude Code extension hit Cursor: check your SSH keys

A trojanized Claude Code extension went out through Cursor's extension marketplace on October 29. It used the real anthropic.claude-code ID, not a lookalike, and it wrote an attacker's SSH key into the user's authorized_keys file. Cursor says at most 5,000 users got it. If your team codes in Cursor, check every machine today. Uninstalling the extension does not clean it up.

What actually happened

Per Cursor's security notice, tampered builds of versions 2.1.312 and 2.1.313 for macOS (Apple Silicon) and Windows were live in Cursor's marketplace from about 2:27 am to 1:35 pm PT on October 29, roughly 11 hours. Cursor says Anthropic did not build them.

What the payload did, per Cursor and BleepingComputer:

• Added an ssh-ed25519 public key labeled svc-telemetry to authorized_keys.
• Sent host details (hostname, username, OS, Git email, and the names of environment variables that look like secrets) to a server on port 8099.
• Tried to turn on SSH and open a reverse tunnel. That step needs admin rights, which the extension usually didn't have.
• Set up persistence: a LaunchAgent on macOS and a scheduled task on Windows. That is why removing the extension is not enough.

Cursor pulled the build, shut down its whole marketplace, rotated its keys, found no other tampered extensions, and got the command server taken offline. It also published cleanup scripts. Anthropic shipped a clean 2.1.314. The official VS Code Marketplace and Open VSX were not affected. Nobody has said yet how the attacker got publish access.

Why it matters for your business

This one is different from the fake lookalike extensions we covered before. Checking the publisher name would not have saved you. The name was right. What you trusted was the marketplace, and that is a vendor you never picked on purpose.

1. Run the check now. Search ~/.ssh/authorized_keys (and C:\ProgramData\ssh\administrators_authorized_keys on Windows) for svc-telemetry. Cursor's notice has the exact commands.
2. If you find it, use Cursor's scripts. Then rotate any keys and sessions on that machine from a clean device. Rebuild if a tunnel connected.
3. Turn off auto-update for extensions on dev machines. Pin versions. Let one machine take updates first.
4. Keep production secrets off laptops. The payload went after names that looked like secrets. Short-lived tokens limit the damage.

Sources: Cursor: Claude Code extension security notice, BleepingComputer.