A trojanized copy of the official Claude Code extension, version 2.1.313, was available in the Open VSX marketplace used by Cursor and other VS Code-based editors for about eleven hours on October 29, 2026. Simply loading it planted an attacker’s SSH key on the machine, opened a hidden remote tunnel and set itself up to survive reboots. Cursor says at most 5,000 users were affected. Anyone who installed 2.1.313 should treat their computer as compromised. A clean version, 2.1.314, was published on October 30.
What did the fake extension do?
It looked and worked like the real Claude Code extension, but carried a small hidden loader. In plain terms, it gave a stranger a permanent back door into your computer:
- Planted a key: added an attacker-controlled SSH key, labelled
svc-telemetry, to your~/.ssh/authorized_keysfile, which lets someone log in to your machine remotely. - Opened a tunnel: started a reverse SSH connection to an outside server so the attacker could reach your machine even behind a home router.
- Stayed hidden: installed persistence disguised as a system service: a scheduled task called "SysMon" on Windows and a LaunchAgent named
com.apple.sysmondon macOS.
No click or approval was needed beyond the editor loading the extension. The attacker’s server has since been taken offline by its hosting provider, but any key or task already planted stays until you remove it.
Am I affected?
Only if you installed version 2.1.313 from Open VSX, the extension store used by Cursor, Windsurf, VSCodium and similar editors, during the window on October 29. Users of the official Microsoft VS Code Marketplace were not the reported target. To check, open your extensions list in Cursor or run cursor --list-extensions --show-versions and look for anthropic.claude-code@2.1.313.
What should I do if I installed it?
- Update the extension to 2.1.314 or later.
- Open
~/.ssh/authorized_keysand delete any line ending insvc-telemetryor any key you do not recognise. - Remove the persistence: on Mac, delete
~/Library/LaunchAgents/com.apple.sysmond.plist. On Windows, delete the "SysMon" scheduled task in Task Scheduler. - Turn off remote login if you never use it (on Mac: System Settings, General, Sharing, Remote Login).
- Rotate secrets on that machine: SSH keys, GitHub tokens, cloud keys and AI API keys, including your Anthropic key.
- If in doubt, reinstall the operating system. Cursor’s own advice is to treat the machine as compromised.
Why do attackers keep targeting AI coding tools?
Because a developer laptop running an AI agent is a master key. It holds source code, cloud credentials and API keys, and the agent already has permission to run commands. This is the latest in a run of supply-chain attacks aimed at exactly that setup, including the poisoned LiteLLM package and GitSpawn. Open VSX has been hit repeatedly this year because it has lighter review than Microsoft’s marketplace and is the default store for several popular AI editors.
The lasting lesson: an extension carrying a trusted name is not proof it came from that company. Turn off automatic extension updates for tools that hold your keys, and check release notes before updating.
Part of our coverage of Black October 2026, every major AI security incident this month.
