PulseAugur
EN
LIVE 02:52:49

Cursor's Claude Code extension tampered, added attacker SSH key

By PulseAugur Editorial · [1 sources] ·

Cursor's marketplace distributed a compromised version of its Claude Code extension for approximately 11 hours on October 29th. The tampered extension, versions 2.1.312 and 2.1.313 for macOS and Windows, automatically executed upon loading and added an attacker-controlled SSH key. Users are advised to check their authorized_keys file for a key labeled 'svc-telemetry' and to follow Cursor's provided cleanup scripts, as simply updating the extension does not remove the malicious key. AI

IMPACT Compromised AI tool extensions can erode user trust and potentially lead to data breaches.

RANK_REASON Security incident involving a third-party tool's extension.

Read on r/cursor →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

Cursor's Claude Code extension tampered, added attacker SSH key

How we ranked this

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
Security incident involving a third-party tool's extension.
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
10 days old
Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.

Full methodology in our editorial standards.

COVERAGE [1]

  1. r/cursor TIER_2 English(EN) · /u/WhichCardiologist800 ·

    Quick check if you got the tampered Claude Code extension (Oct 29)

    <!-- SC_OFF --><div class="md"><p>Cursor’s marketplace served a tampered Claude Code extension (2.1.312 / 2.1.313, macOS and Windows) for about 11 hours on Oct 29. It ran as soon as the extension loaded and added an attacker SSH key.</p> <p>To check: look in ~/.ssh/authorized_key…

RELATED ENTITIES

RELATED TOPICS