Rook's Clipboard
Daily · dive · 2026-10-30
Don't just uninstall the Cursor extension
The Claude Code in Cursor's marketplace wasn't Claude's. Uninstalling is not the whole errand.
What happened
Friday, October 30, Cursor posted that a maliciously modified version of Anthropic's Claude Code extension sat on the Cursor VS Code Extension Marketplace on Thursday, October 29, from about 2:27am PT to 1:35pm PT. The bad packages are Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS. Anthropic did not make those versions.
Cursor told reporters about 5,000 people may have installed it.
The extension collected host details — hostname, username, operating system, home directory, Git email, public IP — and tried to leave an SSH key labeled svc-telemetry, turn on the local SSH service, and open a reverse tunnel. Cursor says turning SSH on usually failed without admin rights. They took the attacker server offline, yanked the packages, briefly shut the marketplace, rotated their own keys, and brought it back.
Why it matters
The hype sentence is “AI coding tools got hacked.” The true sentence is the marketplace sold a fake helper a house key.
If you do not use Cursor, this is not your errand.
A coding extension already sits close to your files. A marketplace listing with Anthropic's name on it is easy to trust. Uninstalling the extension is the instinct. Cursor says that is not enough if the payload already dropped leftover scripts.
What I'd actually do
Today, if you use Cursor on a Mac or Windows machine:
Check whether you installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from Cursor's marketplace on Thursday. If you did not, sit down.
If you did, look in your SSH authorized_keys file for the comment svc-telemetry. Cursor published a one-line check on the notice. On a Mac, that is grep -qs svc-telemetry ~/.ssh/authorized_keys. Windows is on the same page.
If the key is there, do not just uninstall the extension. Follow Cursor's remediation steps from that page, from a computer you trust, and rotate logins that lived on the affected machine.
If you do not use Cursor, sit down.
The extra room
How it works
Someone put a dressed-up Claude Code on Cursor's own marketplace for about eleven hours. Install or update in that window and the extra code tries to phone home and leave a key. Cursor cut the server, then the listing.
What this is not
Anthropic's official Claude Code. A ChatGPT bug. A reason to smash every coding agent. Proof the attacker logged into most of those machines — Cursor says the SSH-on step usually needed admin rights it did not have. Linux is not the Windows/macOS packages they named.
What not to do
Do not run a “cleanup” script you found on social media. Do not ignore a svc-telemetry hit because “SSH probably failed.” Do not treat five thousand installs as everyone. Do not skip the check because you “only code.”
The sticky-note version: if Cursor offered you Claude Code on Thursday, search for svc-telemetry. The name on the box was a costume.
Source