Claude Code extension backdoor: check if you were affected
By NeuralNews · Checked 2 November 2026. An AI-assisted explanation based on Cursor’s security notice and Phorion’s malware analysis. We have not analysed the sample ourselves or run these checks on an infected machine.
What happened?
On October 29, 2026, Cursor identified malicious builds of the anthropic.claude-code extension in its VS Code extension marketplace. The tampered builds installed an SSH backdoor that gives an attacker remote access to the developer’s computer. Cursor states that these versions were not developed by Anthropic, that it removed them on detection, and that it worked with the hosting provider to take the attacker’s server offline. Security firm Phorion published the technical analysis summarised below.
Am I affected?
Cursor’s notice, updated October 30 at 11:30 PT, names versions 2.1.312 and 2.1.313 for Windows and macOS, available between about 2:27 and 13:35 PT on October 29 (14:57 IST October 29 to 02:05 IST October 30). Some earlier reports name only 2.1.313; we follow Cursor’s updated notice. You are at risk if an editor that installs extensions from Cursor’s marketplace or Open VSX, such as Cursor, updated the extension to one of those versions during that window. No malicious version has been reported on Microsoft’s Visual Studio Marketplace, which standard VS Code uses. Check the installed version with the editor command line: cursor --list-extensions --show-versions, then look for anthropic.claude-code. A version that is not 2.1.312 or 2.1.313 today does not prove the machine is clean if it auto-updated through that window, so run the checks below as well.
What does the backdoor do?
According to Phorion, the modified extension.js adds an attacker key with the comment svc-telemetry to ~/.ssh/authorized_keys, tries to enable the SSH server, opens a reverse SSH tunnel to 134.209.82.225 as the user tunnel, reports host details to port 8099 and installs persistence. On macOS persistence is a LaunchAgent named com.apple.sysmond.plist; on Linux an @reboot crontab entry; on Windows a scheduled task named SysMon or a Startup script named sysmon.cmd. Phorion also describes Linux code paths, although Cursor’s notice lists Windows and macOS builds. Phorion notes that on macOS the attempt to enable Remote Login fails for a standard user, which limits inbound access when SSH was not already on; the tunnel and persistence are still a serious risk.
Check a Mac or Linux machine
These commands only read files and process lists; they do not change anything. Any output from the first five lines is a reason to treat the machine as compromised. The last line prints your extension versions for comparison. They cover the indicators published by Phorion, not every possible variant.
grep -n "svc-telemetry" ~/.ssh/authorized_keys
ls -la ~/.config/.smt ~/.config/.smtk /tmp/.stk_* 2>/dev/null
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null
crontab -l 2>/dev/null | grep -n "@reboot"
ps aux | grep -E "134\.209\.82\.225|:8099" | grep -v grep
cursor --list-extensions --show-versions | grep -i claude-codeCheck a Windows machine
Run these in PowerShell as your normal user. They only read state. A task named SysMon, a True result for either path, or a matching authorized_keys line indicates compromise. Cursor’s notice also links detection scripts; prefer those if they cover your setup.
Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue
Test-Path "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd"
Test-Path "$HOME\.config\smt.cmd"
Select-String -Path "$HOME\.ssh\authorized_keys" -Pattern "svc-telemetry" -ErrorAction SilentlyContinue
Get-NetTCPConnection -RemoteAddress 134.209.82.225 -ErrorAction SilentlyContinueWhat to do if you find it
Disconnect the machine from the network first, then follow Cursor’s and Phorion’s steps: stop the tunnel processes connecting to 134.209.82.225, remove the LaunchAgent, crontab entry or scheduled task, delete the .smt, .smtk and .stk files, remove the svc-telemetry line from authorized_keys and check that SSH or Remote Login was not switched on. Update the extension to a version after 2.1.313 from a trusted source. Then rotate credentials from a different, trusted computer: SSH keys, cloud and API tokens, GitHub tokens and any secrets in shell history or .env files that the account could read. Phorion advises rotation where SSH was enabled or an inbound login is evident; for a developer laptop with deployment access, rotating anyway is the cautious choice. If the machine belongs to an employer, report it to the security team before cleaning up, so evidence is preserved.
What is still unknown
At this check, neither Cursor nor Phorion explains how the attacker obtained the ability to publish the extension, and we did not find a statement from Anthropic, the Eclipse Foundation (which runs Open VSX) or Microsoft. A figure of at most 5,000 affected users was attributed to Cursor in press coverage, but it does not appear in Cursor’s updated notice; treat it as unconfirmed. We will update this page when a primary source explains the cause or changes the version list.
Sources and related coverage
This page replaces an aggregated preview at the same address with a separately attributed checklist. Version numbers, times and indicators come from the linked sources; the checking commands are our own and were reviewed against those indicators but not run against the malware. Send a correction with the source that contradicts any statement.