Check the affected Claude Code extension in Cursor
Use Cursor's incident checks and remediation guidance; removing the extension alone may leave persistence.
Published · 1 source · Resume reading
Cursor's notice, updated 2026-10-30, identifies malicious marketplace builds of Anthropic.claude-code 2.1.312 and 2.1.313 on macOS and Windows [1]. Both versions need attention if installed during the incident window on 2026-10-29.
Check the SSH indicator
Cursor identifies svc-telemetry in authorized keys as an indicator. Its macOS check is [1]:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"You should see one of those messages. Treat a negative result as this indicator's result; review Cursor's other indicators if the affected extension was installed. Windows users should use the PowerShell check in Cursor's notice [1].
Follow remediation for affected hosts
Warning: Cursor says uninstalling alone may leave persistence. Isolate hosts showing compromise and use the platform-specific remediation script linked from its notice [1].
The macOS instructions run the downloaded script as the affected user, without root [1]:
bash remediate-macos.shCursor says the scripts return a nonzero status if anything remains. Rotate accessible credentials from a trusted system and assess whether the host needs rebuilding [1].
Keep this guide
Filed under Security, Claude Code