Claude Code extension backdoor: Check 2.1.313 hosts

The compromised Claude Code extension identified itself as anthropic.claude-code version 2.1.313, and it could install persistence even when it failed to enable the host's SSH service. Anthropic has since published 2.1.314. Check the installed version first, then investigate the host — don't assume an extension update removes the backdoor.

Cursor says at most 5,000 users installed the malicious version between roughly 2:27 a.m. and 1:35 p.m. PT on October 29, 2026, according to The Hacker News report. Cursor also says Anthropic did not develop this modified build. For a developer account carrying cloud or deployment credentials, the concern is potential account access, not merely a broken editor extension.

Check the Claude Code extension version on each host

The reported malicious package identifies itself as version 2.1.313. Start by checking the installed extension's package identity and version. Where installation or update history is available, compare it with Cursor's reported exposure window. An extension's current version alone does not establish what previously ran on the machine; the relevant identifier is anthropic.claude-code, and the suspicious version is 2.1.313.

As of October 30, 2026, The Hacker News reports that the malicious version has been removed and Anthropic has published 2.1.314 to both Open VSX and Microsoft VS Code Marketplace. That provides a replacement version; it does not establish that an already affected host has been cleaned.

For a laptop fleet, separate machines with confirmed installation evidence from machines whose earlier extension state is unknown, and record the installed version, available installation history, key findings and persistence findings for each device.

The loader preceded the legitimate extension code

OpenSourceMalware co-founder Jenn Gile identified a malicious 66-line loader placed before the legitimate code in the package's main JavaScript bundle. The extension was designed to activate after VS Code startup and when its webview opened. Its malicious behaviour therefore accompanied an extension that still contained legitimate functionality.

The Hacker News describes the compromised extension on Open VSX and traces the incident to a compromise of Cursor Marketplace. Cursor briefly took its marketplace service down to remove the malware. This is a distribution incident involving a modified package, not a report that Anthropic intentionally shipped the backdoor.

After activation, the malware added an attacker-controlled SSH key, attempted to make the host reachable, established a reverse tunnel, and installed persistence. These are the reported artifacts to check against host and network evidence:

The Claude Code extension package was the delivery mechanism, but the resulting changes extended beyond that package. The key, persistence mechanisms and tunnel explain why removing or replacing the extension cannot be treated as the entire response.

What the beacon exposed from a developer account

The reported beacon collected host and account reconnaissance, including environment-variable names rather than their values. That distinction limits what can be concluded about the initial transmission, but it does not make the information harmless.

The Hacker News reports the following collected fields:

git config --global user.email

Security researcher Paul McCarty explained the difference between the initial beacon and the consequences of successful access:

“Their names can still reveal which cloud providers, CI systems, and credential types are configured. More importantly, successful SSH access would allow the operator to inspect the account directly.”

— security researcher Paul McCarty

For response planning, separate information known to have been included in the beacon from information an operator might have reached through SSH. The report supports investigating both; it does not establish that every configured secret was stolen.

SSH access and the initial compromise remain partly unproven

Installing persistence did not guarantee a successful SSH login. Cursor says enabling the local SSH service requires administrator rights that the extension lacks on most macOS and Windows hosts. On those hosts, that step failed, and Cursor says the attacker could not have logged in through the tunnel.

That limitation does not clear the machine. Cursor says the extension still added the attacker's key, installed persistence and sent host details. Its advice is to perform remediation regardless of whether enabling SSH succeeded.

No other follow-on payloads have been observed, according to the report. This is an observation limit, not evidence that no further access occurred. The reverse tunnel supplied a pathway through which an operator could issue commands or transfer files if SSH access succeeded.

The report also does not explain the initial marketplace compromise in sufficient detail to reproduce it. It provides neither the loader source nor the complete attacker public key, persistence-entry names, or a discovery procedure. I would not present a guessed loader as a reproduction of this incident. The defensible investigation starts with the published artifacts and evidence from the affected host.

There is also no basis here for labelling every earlier extension version, every marketplace copy, or every Claude Code installation as malicious. The concrete package version and Cursor's installation window are the useful starting points for scoping this incident.

Remove Claude Code persistence before restoring the host

The reported remediation is to isolate affected hosts, remove the unauthorized key and persistence, and rotate credentials and sessions. I'd prioritise that host-level response over a routine extension upgrade because the reported changes survive outside the extension's own files.

Use the following sequence as a response checklist for a confirmed installation:

1. Isolate the affected host. Follow the recommendation to separate the machine before returning it to normal development work. Do not treat a failed SSH-service activation as a reason to skip the rest of the response.
2. Remove the unauthorized SSH key. Inspect the reported ~/.ssh/authorized_keys artifact and the svc-telemetry label. The report does not publish the full public key, so the label alone is not a complete key fingerprint.
3. Remove the installed persistence mechanisms. The report identifies platform-specific persistence using a scheduled task, crontab and LaunchAgent. It does not provide their exact names or contents, so a verified deletion command cannot be supplied from the published details.
4. Rotate credentials and sessions associated with the affected account. Do not restrict the review to values supposedly transmitted in the initial beacon: successful SSH access would have allowed inspection of the account itself.
5. Replace the malicious extension with Anthropic's published 2.1.314. Keep this package replacement separate from confirming that the unauthorized key and persistence have been removed.

For the Claude Code extension, the practical distinction is between replacing the delivery package and undoing the host changes. Use the published replacement rather than retaining the reported malicious build, but restore an affected machine to normal use only after the key, persistence and credential response have been addressed.