# Claude Code extension 2.1.313 — tampered build carried an SSH backdoor

> A modified Claude Code extension, version 2.1.313, planted an SSH backdoor on developer machines through the Cursor marketplace.

- Org: Cursor
- Date: 2026-10-29
- Category: security, ecosystem
- Source: https://cursor.com/blog/claude-code-extension-security-notice
- Canonical page: https://ai-tldr.dev/releases/claude-code-extension-2-1-313-backdoor/

Cursor says a tampered Anthropic.claude-code 2.1.313 was live in its extension marketplace for about 11 hours on 29 October. It adds an SSH key and a reverse tunnel. Cursor says at most 5,000 users were affected.

## What it is

Cursor published a security notice about a malicious build of the Anthropic.claude-code VS Code extension, version 2.1.313, that it says was not developed by Anthropic. The build was available in the Cursor extension marketplace for roughly 11 hours on 29 October. Cursor says at most 5,000 users were affected. Who published it is not stated; Phorion and Doublepulsar describe the compromise differently, and Anthropic has made no public statement in the sources we read.

## How it works

The tampered extension.js runs injected code as soon as the extension loads. It collects host details, adds an attacker key labeled svc-telemetry to authorized_keys, tries to enable SSH and opens a reverse SSH tunnel to 134.209.82.225. It adds a LaunchAgent on macOS or a scheduled task named SysMon on Windows, so the tunnel retries about every 60 seconds. It also sends a beacon to port 8099 on the same server.

## Why it matters

Uninstalling the extension does not remove the persistence scripts or the SSH key, so affected developers must clean up by hand and rotate credentials. Cursor says the attacker server is offline, so the shell and beacon no longer work. The incident shows that auto-updating editor extensions are a real route to developer laptops, and that fork marketplaces such as Open VSX carry their own risk.

## Who it's for

developers who use Claude Code in Cursor or other VS Code forks

## Try it

macOS: grep -qs svc-telemetry ~/.ssh/authorized_keys

## Quick facts

- Affected version: Anthropic.claude-code 2.1.313 (darwin-arm64 and win32-x64 builds)
- Live window: About 2:27am to 1:35pm PT, 29 October 2026, in the Cursor marketplace
- Users affected: At most 5,000, per Cursor
- Payload: Attacker SSH key, reverse SSH tunnel, persistence, host beacon
- Detection: Look for an SSH key labeled svc-telemetry in authorized_keys
- Fixed version: 2.1.314, per the Doublepulsar report

## FAQ

### How do I know if the Claude Code extension backdoor hit my machine?

Cursor says to search the SSH authorized_keys file for a key labeled svc-telemetry. On macOS, run grep -qs svc-telemetry ~/.ssh/authorized_keys. On Windows, search $HOME\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys. If the key is present, Cursor treats the machine as impacted and says to isolate it.

### Does uninstalling the Claude Code extension remove the backdoor?

Uninstalling is not enough, according to both Cursor and Phorion. The malicious Claude Code build 2.1.313 installs standalone persistence: a LaunchAgent on macOS or a SysMon scheduled task on Windows. Cursor offers remediation scripts, advises assessing a rebuild of the machine, and tells affected users to rotate credentials reachable from the host.

### Did Anthropic publish the malicious Claude Code extension?

That is unclear. Cursor states the malicious version was not developed by Anthropic. Doublepulsar's Kevin Beaumont argues Anthropic was compromised and says Anthropic replaced 2.1.313 with 2.1.314 without telling customers. Hacker News commenters say the publishing account is unconfirmed. No Anthropic statement appeared in the sources we checked.

### Which Claude Code users are affected by the 2.1.313 backdoor?

Cursor says the affected package is Anthropic.claude-code 2.1.313 for darwin-arm64 and win32-x64, served from its marketplace for about 11 hours on 29 October, and that at most 5,000 users were affected. Cursor reports no evidence that other versions or the official distribution are affected, and it says it will contact affected users directly.

## Links

- [Cursor Security Notice](https://cursor.com/blog/claude-code-extension-security-notice)
- [Phorion Analysis](https://phorion.io/blog/offical-claude-code-vsx-compromise/)
- [HN Discussion](https://news.ycombinator.com/item?id=50301983)