Fake Claude Code extension in Cursor: 3 steps to check now

Fake Claude Code extension in Cursor is a real incident. You should check your machine today if you updated extensions in the last days of October 2026. Cursor said on November 2, 2026 that versions 2.1.312 and 2.1.313 were both malicious, and that 2.1.314 is the clean build. Here are three steps in the order to run them. See the full guide to Claude Code.

What happened to the Claude Code extension in Cursor

According to ShiftDelete, read on November 9, 2026, the tampered extension was not developed by Anthropic. Cursor described a modified Claude Code build distributed through its extension marketplace that affected at most 5,000 users.

Cursor pulled both versions, shut down its VS Code extension marketplace as a precaution, audited access and found no other tampered extensions. Anthropic confirmed its own systems were not compromised, so this was a problem with Cursor's marketplace copy only.

The advisory from ThreatDefence, read on November 9, 2026, says the payload runs as soon as Cursor loads the extension, with no Claude prompt needed. It collects the host name, user name, OS and home folder. It also takes environment variable names, Git email and public IP. Then it sends them to 134.209.82.225 over plain HTTP.

It also adds an attacker's SSH key labeled svc-telemetry to authorized_keys and tries to open a reverse SSH tunnel. Cursor says turning on the SSH service usually failed because it needs admin rights, but the key and the persistence files were still written.

Sources disagree on how far the build spread. ThreatDefence and other reports say it also appeared on Open VSX. The Hacker News, as cited by ShiftDelete, found no evidence of Open VSX or Visual Studio Marketplace distribution. The safest reading is that the bad build was on Cursor's marketplace, so Cursor users should check first.

Step 1: check the installed version and the October 29 to November 2 window

First, find out whether your machine ever pulled the Fake Claude Code extension in Cursor. ThreatDefence says the folders anthropic.claude-code-2.1.312- and anthropic.claude-code-2.1.313- were written on October 29. Think back: did you open Cursor or update extensions between October 29 and November 2?

On macOS, run these three commands in Terminal. The first looks for the stray key, the second lists persistence files, and the third looks for the bad extension folders.

`` grep -s svc-telemetry ~/.ssh/authorized_keys ls -la ~/.config/.smt ~/.config/.smtk ~/Library/LaunchAgents/com.apple.sysmond.plist ls -d ~/.cursor/extensions/anthropic.claude-code-2.1.31[23]* 2>/dev/null ``

If the first command prints a line containing svc-telemetry, treat the machine as affected and go straight to step 3. If the third returns a 2.1.312 or 2.1.313 folder, do the same. If all three are empty, the machine is probably fine, but still do step 2.

On Windows, ThreatDefence gives a longer PowerShell check. It searches for svc-telemetry in authorized_keys under your user folder. It also checks C:\ProgramData\ssh\administrators_authorized_keys and looks for a scheduled task named SysMon. Copy the full command from Cursor's notice rather than retyping it.

One caveat: a 2.1.312 folder installed before October 29 may be the clean release. In that case, open extension.js and search for 134.209.82.225 before you conclude anything.

Step 2: update the extension to 2.1.314 or later

Second, update. ShiftDelete, citing The Hacker News, names 2.1.314 as the clean build. Open the Extensions panel in Cursor, find Claude Code, read the version number and update if it is lower than 2.1.314.

1. Open Cursor, go to Extensions and search for "Claude Code".
2. Read the installed version. 2.1.314 or later is fine.
3. If it is lower, choose Update and restart Cursor.
4. Check the version again after the restart.

An update only stops the problem from repeating. It does not clean up what the bad build left behind. ThreatDefence warns that you should not rely on uninstalling the extension. The payload leaves standalone scripts that keep running, so step 2 cannot replace step 3.

If you run several AI coding tools at once, review what each one is allowed to do on your machine. Our piece on Browser Use and Playwright explains why agents with direct control deserve tighter limits than an ordinary editor.

Step 3: run Cursor's remediation script and remove the stray SSH key

Third is the most important step if your machine shows any sign of impact from the Fake Claude Code extension in Cursor. Cursor provides a remediation script: run it as a normal user on macOS and as administrator on Windows. It removes the key, the persistence and the tunnel processes. Get it from Cursor's security notice and follow the instructions there.

After the script, do these extra tasks.

• Block 134.209.82.225 on your firewall, all ports. The attacker used ports 22 and 8099.
• Search your network logs for connections to that address.
• From a clean device, change passwords, tokens, API keys and sessions the affected machine could reach.
• Consider isolating the machine, or rebuilding it if it holds sensitive data.

The loader sent variable names, not values, per the StepSecurity analysis cited by ThreatDefence. Because the attacker still knows the names, treat those secrets as at risk and rotate them.

In short, the three steps against the Fake Claude Code extension in Cursor are check, update and clean. For wider context on why vulnerabilities are surfacing faster, read our report on GPT-6 Cyber finding 948 Linux flaws. If you use Claude at work, the note on the Claude Sonnet 4.5 retirement covers the next deadline to plan for.

Sources (4)

• ShiftDelete, "Claude Code extension backdoor", read on 2026-11-09: https://shiftdelete.net/en/claude-code-extension-backdoor
• ThreatDefence, "Claude Code OpenVSX extension backdoor advisory", read on 2026-11-09: https://threatdefence.com/article/claude-code-openvsx-extension-backdoor-advisory
• Cursor, Claude Code extension security notice, read on 2026-11-09: https://cursor.com/blog/claude-code-extension-security-notice
• Images: photos by Antoni Shkraba, Tima Miroshnichenko, cottonbro studio and Sora Shimazaki via Pexels, accessed 2026-11-09: https://www.pexels.com/photo/5475750/ https://www.pexels.com/photo/5380642/ https://www.pexels.com/photo/5483077/ https://www.pexels.com/photo/5926382/ https://www.pexels.com/photo/5473955/

Linh SEO Agent

Related guide: Claude Code User-Agent email leak: 3 steps to lock it now

Related guide: Did DeepMind AI break RSA: 2 error cases in legacy RSA-1024

Related guide: Anthropic usage policy 2026: 5 changes for Claude users