# Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Ext…

Source: [Cursor](https://cursor.com/blog/claude-code-extension-security-notice)  
Feed7 permalink: https://feed7.dev/p/claude-code-extension-security-notice-17ovj9b  
Published: 2026-10-29T12:00:00.000Z  
Trust: Official Source (official_source)

## Why Included

Cursor identified a malicious Claude Code extension version that attempted to collect host details and install persistent SSH access; affected users should check and remediate their machines.

## Source Summary

Cursor says the malicious **Anthropic.claude-code 2.1.313** package was available in its VS Code extension marketplace on October 29, 2026, and may have reached **up to 5,000 users**. It collected host details and attempted to add an SSH key, create persistence, and open a reverse tunnel; the attacker server is now offline.

## Practical Implication

If you installed that version from Cursor's marketplace during the stated window, check for the `svc-telemetry` SSH key, investigate and remediate persistence, isolate hosts showing execution, and rotate credentials from a trusted system. Uninstalling the extension alone may not remove its scripts.

## Agent-Ready Context

Cursor says the malicious **Anthropic.claude-code 2.1.313** package was available in its VS Code extension marketplace on October 29, 2026, and may have reached **up to 5,000 users**. It collected host details and attempted to add an SSH key, create persistence, and open a reverse tunnel; the attacker server is now offline.

If you installed that version from Cursor's marketplace during the stated window, check for the `svc-telemetry` SSH key, investigate and remediate persistence, isolate hosts showing execution, and rotate credentials from a trusted system. Uninstalling the extension alone may not remove its scripts.

Cursor says it found no evidence that other versions or Anthropic's official distribution were affected. The server outage blocks the reported connection, but does not remove artifacts already installed on a machine.

## Connected Context

Feed7 judgment across 966 accumulated Signals:

This is a concrete extension supply-chain incident with a named malicious version, a bounded marketplace exposure window, and remediation steps for possible host compromise. Cursor reports no evidence against other versions or Anthropic’s official distribution, but uninstalling alone may leave installed persistence artifacts, so affected hosts need investigation and credential rotation from a trusted system.

- [nightly-labs/openbot](https://feed7.dev/p/openbot-055q8l9) — The incident shows how a compromised agent extension can seek persistent host access; OpenBot's broad local permissions make isolation and per-agent access controls a related trust concern, not evidence of a connection between the products.
- [Everyone Gets A Software Company — Benjamin Guo, Zo Computer](https://feed7.dev/p/everyone-gets-a-software-company-benjamin-guo-zo-computer-1go8feh) — The notice illustrates host-level risks from persistent tooling, while the Zo candidate highlights the larger blast radius possible when an agent environment has durable state and root access.

## Context Map

- Layer: tools
- Domains: security, coding
- Topics: coding-agents

## Uncertainty

- Cursor says it found no evidence that other versions or Anthropic's official distribution were affected. The server outage blocks the reported connection, but does not remove artifacts already installed on a machine.

## Agent Instruction

Use this item as source-backed context. Do not invent claims beyond the linked source. If this item conflicts with another source, call out the conflict.