A fake Claude Code update put a backdoor on up to 5,000 computers.
Cursor, the AI code editor, said a tampered Claude Code extension sat in its add-on store on Thursday. For 11 hours, version 2.1.313 quietly added an attacker's login key and a hidden tunnel to users' machines. Cursor pulled it and says Anthropic did not make it, but removing the extension alone does not clean a machine.
Why it mattersIf you used Claude Code inside Cursor on Thursday, look for a key named svc-telemetry in your SSH settings. Cursor has published cleanup scripts, and you should change any passwords that machine could reach.
Read in the app — free, in 9 languages
Related stories
Reddit will soon make you log in just to read it.2026-10-30A worker's personal Claude agent sat on a Pentagon network for months.
2026-10-30GitHub's Copilot now picks the AI model for each coding task itself.
2026-10-29Mistral gave away its trillion-parameter model, with one catch.
2026-10-29Google's Gemini 4 Carbon edged past Claude on a hard AI ranking.
2026-10-29