A malicious extension reached Cursor users. Check the workstation, not just the marketplace.

Cursor says the malicious Anthropic.claude-code version 2.1.313 was available in its marketplace on 29 October, from 2:27 a.m. to 1:35 p.m. Pacific time. Its upper-bound estimate is 5,000 users who may have received the update. That is not a count of compromised machines, and the notice does not say Anthropic authored the malicious package.

According to Cursor, the payload attempted to add an SSH key named svc-telemetry, set up persistence through a macOS LaunchAgent or Windows scheduled task, and establish a reverse tunnel. Cursor says the typical non-administrator installation would fail to enable SSH, but other parts of the payload could still run. Cursor also says the attacker-controlled server was taken offline.

1. 1

   Find affected hosts. Identify Cursor installations that received the named extension version during the stated window. Preserve extension records before cleanup.

2. 2

   Use the vendor indicators. Check Cursor's notice for its current indicators and remediation instructions. Review SSH configuration, LaunchAgents or scheduled tasks, and outbound connections on affected hosts.

3. 3

   Scope trust, then recover. If execution is plausible, isolate the host, preserve evidence, and assess repository, cloud and developer credentials it could access. Rotate affected secrets and rebuild where integrity cannot be established.

Developer extensions run close to code and credentials. Record which workstation received the update, what the host actually did, and why the team considers it clean. Removing the extension alone does not answer those questions.