# Check the affected Claude Code extension in Cursor

> Use Cursor's incident checks and remediation guidance; removing the extension alone may leave persistence.

Source: https://fullbytedeveloper.com/blog/cursor-claude-extension-security-check
Keyword: EXTENSION
Published: 2026-11-01T03:16:16.000Z

Cursor's notice, updated 2026-10-30, identifies malicious marketplace builds of `Anthropic.claude-code` 2.1.312 and 2.1.313 on macOS and Windows [1]. Both versions need attention if installed during the incident window on 2026-10-29.

## Check the SSH indicator

Cursor identifies `svc-telemetry` in authorized keys as an indicator. Its macOS check is [1]:

```bash
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
```

You should see one of those messages. Treat a negative result as this indicator's result; review Cursor's other indicators if the affected extension was installed. Windows users should use the [PowerShell check in Cursor's notice](https://cursor.com/blog/claude-code-extension-security-notice#check-whether-you-are-impacted) [1].

## Follow remediation for affected hosts

**Warning:** Cursor says uninstalling alone may leave persistence. Isolate hosts showing compromise and use the platform-specific remediation script linked from its notice [1].

The macOS instructions run the downloaded script as the affected user, without root [1]:

```bash
bash remediate-macos.sh
```

Cursor says the scripts return a nonzero status if anything remains. Rotate accessible credentials from a trusted system and assess whether the host needs rebuilding [1].

## Sources

1. [Cursor security notice, updated 2026-10-30](https://cursor.com/blog/claude-code-extension-security-notice)

## Original posts

- [TikTok photos](https://www.tiktok.com/@fullbytedeveloper/photo/7702460966402886933)
- [Instagram post](https://www.instagram.com/fullbytedeveloper/p/DfHwJxwm6Hi/)