Cursor warning: uninstalling the malicious Claude Code extension may not be enough

Cursor disclosed on October 29, 2026 that tampered Claude Code extension builds had reached its marketplace. The builds have already been removed, but uninstalling an affected extension alone may leave malicious startup scripts and an unauthorized SSH key behind.

The download source matters as much as the version

The exposure window covers macOS and Windows users who installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code Extension Marketplace on October 29, between 2:27 a.m. and 1:35 p.m. PT (09:27–20:35 UTC). Having either version installed does not, by itself, establish compromise.

Cursor says the modified builds were not developed by Anthropic and reports no evidence that other extension versions or the official distribution were affected. StepSecurity’s updated report says this was not a compromise of Anthropic’s systems and distinguishes the malicious Cursor packages from the clean 2.1.312 package distributed through Open-VSX.

Why removing the extension can leave scripts behind

The payload adds an unauthorized SSH key labeled svc-telemetry and tries to enable local SSH access and a reverse tunnel. It also installs independent startup mechanisms: a LaunchAgent on macOS, or a scheduled task with a Startup-folder fallback on Windows. Those scripts can remain after the extension is uninstalled.

Cursor says code errors and administrator-rights requirements meant SSH enablement failed on most non-administrator hosts, preventing attacker login through the tunnel on those hosts. Leftover keys and persistence files still require cleanup. The initial data sent to the attacker included host and user information and environment-variable names—not their secret values—but that limited collection does not rule out later credential access through a working backdoor.

Use Cursor’s cleanup guidance on affected machines

Cursor’s official security notice provides platform-specific checks and remediation scripts: https://cursor.com/blog/claude-code-extension-security-notice. If a machine shows evidence of payload execution or backdoor installation, isolate it, remove the unauthorized key, persistence mechanisms and running tunnel processes, and assess whether it needs rebuilding. Rotate credentials and sessions accessible from that machine using a trusted, clean system.

Cursor has rebuilt and reopened its marketplace, rotated its keys and worked with the hosting provider to take the attacker’s server offline. Those containment steps do not remove artifacts already installed on an affected computer.