If your editor installed version 2.1.313 of the Claude Code extension, updating to 2.1.314 did not clean your machine. That build added an attacker’s SSH key and startup scripts that live outside the extension, so the fix has to happen on the machine itself.
In Backdoors in official Claude Code extensions, Kevin Beaumont reports the compromise and confirms the replacement versions don’t remove the backdoor. Below: the myth, the evidence, and the checks to run today.
Table of Contents
- The myth: the update fixed it
- What 2.1.313 actually did
- Why updating or uninstalling isn’t enough
- How bad is it really?
- What to do today
- FAQ
- Sources
The myth: the update fixed it
Extensions auto-update, so most developers assume a bad version is gone once a good one lands. That works when the damage stays inside the extension’s own folder.
Here it didn’t. Per Beaumont, 2.1.314 auto-updated overnight, and he confirmed it does not remove the earlier backdoor or the recon activity. “You need to manually remediate every impacted VSCode and Cursor system,” he wrote.
What 2.1.313 actually did
Phorion, the security company that found it, published a technical write-up. The malicious code was prepended to the extension bundle and ran as soon as Node loaded the file, before the extension’s activate callback. You didn’t have to open or use the extension.
Per Phorion and Cursor’s security notice, the payload:
- appended an attacker Ed25519 key with the comment
svc-telemetryto~/.ssh/authorized_keys - tried to turn on the local SSH service and open a reverse SSH tunnel
- installed persistence: a LaunchAgent on macOS, a scheduled task on Windows
- retried the tunnel roughly every 60 seconds
- sent hostname, username, OS, environment variable names, Git email and public IP to a server on port 8099
Cursor says the bad build was live in its marketplace from about 2:27am to 1:35pm PT on October 29, and that at most 5,000 of its users were affected.
Why updating or uninstalling isn’t enough
The key sits in your home directory. The persistence lives in your OS startup mechanisms. Neither belongs to the extension, so replacing or removing the extension leaves both behind.
Cursor says it plainly: “Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.” That’s why its notice ships remediation scripts instead of just a new version.
Who was breached is still disputed. Beaumont says the build was uploaded to Anthropic’s verified account. Cursor says the version “was not developed by Anthropic”. For cleanup it doesn’t matter: the files are on your disk either way.
How bad is it really?
Less bad than the first headlines, for most machines. Turning on SSH needs admin rights, and Cursor says the step failed on most macOS and Windows hosts. Phorion found a bug that made the macOS check skip the enable step entirely. Cursor and its hosting provider also took the attacker’s server offline.
One developer in the discussion called the “tens of millions of developers” framing hyperbolic. Fair, but the key, the persistence and the data upload still happened. Linux hosts with passwordless sudo, or Macs that already had Remote Login on, were reachable.
Developers in the thread also pointed at a bigger gap. VS Code’s new auto-update delay doesn’t apply to publishers it trusts, and you can’t edit that list. Another developer runs agent tools only in a VM with no production access, which limits what a bad extension can reach.
What to do today
- Check for the key on macOS or Linux:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo found. On Windows, use the PowerShell check in Cursor’s notice. - Phorion advises matching the key fingerprint too, since the comment string is easy to change.
- If you find it, run Cursor’s remediation script for your platform. It removes the extension, the persistence, the tunnel and the key.
- Rotate tokens and credentials that machine could reach, from a different, clean machine.
- Consider rebuilding the host, as Cursor suggests, if you can’t tell what ran on it.
- Check every developer laptop on your team that runs VS Code or Cursor, not just yours.
My rule: when an extension ships malware, I treat the whole machine as suspect until it’s checked.
FAQ
Which version was backdoored?
Claude Code for VS Code 2.1.313. Phorion, Cursor and Beaumont all name it. Beaumont says 2.1.314 is the replacement.
Does updating to 2.1.314 remove the backdoor?
No. Beaumont confirmed the replacement versions don’t remove the SSH key or the persistence. You need to clean the machine by hand or with Cursor’s scripts.
Was the official VS Code marketplace affected?
Beaumont says the extension for both VS Code and Cursor was compromised. Phorion says 2.1.313 was also pulled from the npm and VS Code registries. Check your machine either way.
How do I know if I’m affected?
Look for svc-telemetry in ~/.ssh/authorized_keys. Cursor says that if the key is there, the machine is impacted.
Could the attacker log in to my machine?
Only if SSH was running. Cursor says enabling it failed on most macOS and Windows hosts without admin rights. The key and the persistence were still installed, so clean up anyway.
Is the attacker’s server still running?
No. Cursor says it worked with the hosting provider to take it offline.
Sources
- Article: Backdoors in official Claude Code extensions by Kevin Beaumont, plus his follow-up posts in that thread.
- Technical analysis: Official Claude Code Extension Compromise: Security Advisory by Phorion.
- Vendor notice: Security notice: malicious version of Anthropic.claude-code (2.1.313) by Cursor.
- Discussion: https://news.ycombinator.com/item?id=50302334, for the auto-update delay, the VM setup and the “hyperbolic” pushback.