- Two tampered versions of Claude Code, 2.1.312 and 2.1.313, appeared in Cursor's add-on store.
- According to Phorion's analysis, the code added the attacker's SSH key, opened a tunnel to their server and sent details about the computer.
- Cursor removed both versions; according to The Decoder up to 5,000 people may be affected.
In short: two tampered versions of the Claude Code add-on appeared in the add-on store of the Cursor editor. On 30 October 2026 the security firm Phorion described a back door inside them: the code ran on its own when the editor started, with no click needed.
What the tampered add-on did
According to Phorion’s analysis, a malicious prefix added to the extension.js file worked in four steps:
- it added the attacker’s key (labelled
svc-telemetry) to the list of trusted SSH keys and tried to switch on remote login; - it opened a tunnel to the attacker’s server and retried it every 60 seconds, even after the editor was closed;
- it set itself up to return after a restart: on a Mac as
com.apple.sysmond.plist, on Windows as a scheduled task calledSysMon, on Linux through the scheduler; - it sent the computer and user name, the Git email address, the public IP address and the names (not the values) of secret variables, such as those containing “KEY” or “TOKEN”.
Phorion points out a bug in the Mac version: without administrator rights remote login usually did not switch on. The keys and the automatic start stayed on disk anyway.
Scale and response
- The affected versions are 2.1.312 and 2.1.313; Cursor removed them and published a notice.
- According to The Decoder, quoting Cursor, the version was available for about 11 hours and could have reached up to 5,000 people; Anthropic had no part in building it.
- Cursor took the whole store offline while cleaning up, then restored it.
What to do if you use Cursor
Check your extensions folder for versions 2.1.312 or 2.1.313. Phorion stresses that uninstalling the add-on alone does not remove the back door: you need to stop the tunnel process, delete the automatic start entries, remove the svc-telemetry key from the authorized_keys file and change every password and key reachable from that account. This analysis comes from a company that sells endpoint protection, but the list of traces is concrete and easy to check. I write more about this tool in the Claude Code hub and about the risks in the AI code security hub.