Your Claude Code update may have handed a stranger the keys to your laptop

On 29 October, for about eleven hours, 's extension marketplace served a modified build of Anthropic's extension. Same name, same publisher ID (anthropic.claude-code), versions 2.1.312 and 2.1.313. Editors with auto-update on installed it without asking. This was not a fake extension with a lookalike name. It was the real one, poisoned.

Cursor says at most 5,000 users installed it, between 2:27 and 13:35 Pacific time. Only Cursor's marketplace served it: early reports that Open VSX and the Microsoft marketplace were hit turned out to be wrong. Anthropic has since published 2.1.314. Nobody has explained yet how the attacker could publish under Anthropic's name.

What the code did

A short loader sat in front of the normal extension code and ran when the editor started, no click needed. It:

added an SSH key labelled svc-telemetry to ~/.ssh/authorized_keys, a name picked to look harmless;
tried to switch on the SSH server and open a reverse tunnel to the attacker's server;
installed persistence: a LaunchAgent on macOS (com.apple.sysmond), a scheduled task SysMon on Windows, a @reboot cron entry on Linux;
sent the machine's details home: host name, user name, operating system, public IP, Git email, and the names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP.

The names, not the values. But the names tell an attacker which cloud and which CI you use, and an open SSH door lets them read the values later.

Bugs in the malware saved many people. Switching on the SSH server needs admin rights, which an editor normally does not have, so on most macOS and Windows machines the tunnel never worked. Cursor still says to clean up regardless: the key and the persistence were installed anyway. The attacker's server is offline now.

Check your machine

If you used Claude Code inside Cursor that day, run this on macOS or Linux:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "FOUND: follow Cursor's steps" || echo "not found"

On Windows, Cursor's security notice has the PowerShell check and a remediation script for both systems. If the key is there: isolate the machine, remove the key and the persistence, and rotate every credential that machine could reach, from another, clean machine. Uninstalling the extension is not enough, the scripts it left keep running.

The lesson for teams that use coding agents

The agent extension is the most trusted program in our editor. It reads the whole repository, runs commands, sees the .env file. And it updates itself, silently. We review every line the agent writes. We do not review the agent.

So treat it like a dependency, because it is one:

Pin agent extensions in the team. Turn off auto-update for them and update on purpose, a day or two after a release. A one-day delay would have skipped this attack completely: it was pulled within eleven hours.
Install from the publisher's own channel when there is one, not from whichever marketplace your editor happens to use.
Keep secrets out of the shell environment on developer machines. Load them per project, with short-lived . A list of variable names was the first thing this malware wanted.
Open authorized_keys once in a while. Few of us ever do. It takes ten seconds and it is exactly where this attack lived.

Fast and safe is not only about the code the agent writes. It is also about the tools that make us fast.

Sources: Cursor's security notice, BleepingComputer, The Hacker News.

Tech news, here, from today

This is the first news post on this blog. From now on I will write up the technical news that matters to engineers a few times a week: frontend releases, AI agents, security, and tech in Morocco and the Arab world. Short, with what it means for your team, in English, French and Arabic. Follow along on LinkedIn or with the RSS feed.