Between roughly 2:27am and 1:35pm PT on 29 October 2026, the official Anthropic.claude-code extension was replaced in the Cursor marketplace with a build that installs a persistent SSH backdoor. It auto-updates, so nobody chose it. The fixed version does not remove what the bad one left behind. This page has a free, read-only checker and the list of what a defensible evidence report must contain.
| Date | Fact | Source |
|---|---|---|
| 29 Oct 2026 | Malicious Anthropic.claude-code 2.1.313 served in the
Cursor VS Code marketplace from ~02:27 PT to ~13:35 PT. Cursor says at most 5,000 users; the
extension is one of the most installed in DevOps, so the population exposed to the auto-update
is far larger. | Cursor security notice |
| 29-30 Oct 2026 | 2.1.313 pulled from registries; 2.1.314 published as "fixed". Anthropic had not disclosed the incident at the time of reporting, and the replacement builds do not remove prior backdoors or reconnaissance activity. | Kevin Beaumont, 30 Oct |
| 30 Oct 2026 | Technical analysis: injected IIFE runs on module load, appends an
attacker Ed25519 key to ~/.ssh/authorized_keys, drops a tunnel key in the temp dir,
installs a user LaunchAgent, and beacons host recon to the operator. | Phorion advisory |
The collected reconnaissance is the part boards underestimate: hostname, username, home directory path, configured Git email, working directory names and environment variable names were posted out. Env var names alone tell an attacker which cloud and API credentials exist on the machine.
The definitive marker is one line in one file — the planted key carries the comment
svc-telemetry:
grep -qs svc-telemetry ~/.ssh/authorized_keys \ && echo "IMPACTED" || echo "key not present"
That single check misses the persistence, the temp-directory key, and the running tunnel. The full read-only checker on this page looks at all of them, writes a dated evidence file, and exits non-zero if anything is found:
curl -fsSLO https://sam-bombay.github.io/ai-price-watch/claude-check/check.sh bash check.sh
Fleet mode, one line per host, on any Mac or Linux box you can read:
bash check.sh /Users/ana /Users/dev1 /home/ci # add --sudo-free paths you can read
The same indicators in machine-readable form, CC-BY, for your SIEM or scanner: github.com/Sam-Bombay/claude-code-2.1.313-iocs — hashes, key fingerprints, artifact paths per platform, process strings, removal order.
Read-only. Nothing is uploaded, nothing is changed, no account, no agent install.
It checks every editor's extension folder, authorized_keys by comment and
by published fingerprint, .stk_* temp keys, ~/.config/.smt, the
com.apple.sysmond LaunchAgent, cron persistence, live tunnel processes, and sockets
to the published C2 address.
An email that says "we looked, all clear" is worth nothing to a client, an insurer or a board. The record needs, per host: the checker version and run time, the exact indicators tested, the result of each, the evidence file, and the disposition — cleaned in place, or rebuilt. Then the rotation list, because a host with a backdoor on it means every credential that touched it is suspect.
| Deliverable | What is in it | Price |
|---|---|---|
| Fleet evidence report (up to 20 hosts) | Dated SHA-256-stamped report per host, indicator matrix against both published advisories, list of every host still carrying the key, persistence or tunnel, and the remediation queue in priority order. | $500 |
| Report + remediation verification | The above, then re-run after cleanup: key gone, LaunchAgent gone, tunnel key gone, no socket. Plus the credential-rotation record, signed off per host. | $1,500 |
Start a fleet check — reply with host count, editors in use, and your deadline. Same-day turnaround is possible while the window is fresh.
Do these in this order, and do not skip 4:
1. Take the host off the network. Snapshot it before touching anything. 2. Remove the svc-telemetry key from ~/.ssh/authorized_keys (check fingerprints, not just comments). 3. Remove ~/.config/.smt, ~/.config/.smtk, $TMPDIR/.stk_*, and ~/Library/LaunchAgents/com.apple.sysmond.plist, then unload the agent. 4. Rotate every credential reachable from that host — cloud keys, GitHub tokens, npm tokens, .env files, SSH keys, browser sessions. Recon is a foothold, not the whole attack. 5. Decide rebuild vs clean. Clean is defensible only with the evidence file and a re-check. Cursor publishes the official removal scripts: remediate-macos.sh / remediate-windows.ps1.
Honest limits: the malicious build contained a macOS bug that usually fails to enable Remote Login when started as a normal user, so on many Macs the attacker could reach the tunnel endpoint but not log in. That does not make the host clean — the key and the persistence were still written, and any machine with Remote Login already on (common on machines with remote-SSH extensions) was fully exposed. The attacker server was taken offline on 29-30 Oct, so a clean network check today proves nothing about yesterday.