Daily · · Cursor · 🌶️🌶️🌶️Act nowSpicy: act now (security, deadline, breaking, big launch) Why: A backdoor key may still be on disk
Cursor Claude Code malware: Check SSH keys
Action needed: a tampered Claude Code extension in Cursor’s extension marketplace tries to plant an SSH backdoor. Cursor’s Oct 29, 2026 notice says versions 2.1.312 and 2.1.313 were not made by Anthropic and were live from about 5:27 a.m. to 4:35 p.m. ET that day.
If you installed or updated either in that window, check for the svc-telemetry key now.
What changed
If the bad build ran, uninstalling it may not be enough.
Cursor says it adds an attacker’s SSH key labeled svc-telemetry to your authorized keys, installs startup scripts that retry a reverse SSH tunnel roughly every 60 seconds, and sends host details such as your hostname, username, Git email and public IP to the attacker.
How bad it is
Cursor worked with the hosting provider to take the attacker’s server offline, so the tunnel and the host-detail upload no longer work.
Turning on the local SSH service needs admin rights, which the extension doesn’t have on most macOS and Windows machines, so on those the attacker couldn’t log in through the tunnel. The key and the startup scripts still land, so Cursor says to clean up regardless.
It removed the version, rebuilt the marketplace, and has no evidence that other versions of the extension or the official distribution are affected.
What to do
- Check for the key. On macOS:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
- On Windows, in PowerShell:
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }
- Key found? Isolate the machine and run Cursor’s remediation script from the notice, on macOS as your own user (not root) and on Windows from PowerShell opened with Run as Administrator. The scripts remove the extension, the startup tasks, the tunnel processes and the key. Then decide whether to rebuild the machine.
- From a trusted machine, rotate the credentials and sessions the affected one could reach.
- Security teams can search endpoint, network and extension-install logs for the indicators Cursor lists in the notice.