Malicious Claude Code extension: remote access risk for PCs
In brief
According to Cursor, a malicious Claude Code extension (version 2.1.313) was distributed in its marketplace on 29 October and installed by about 5,000 people. Analyses cited in the report say the code added an SSH key and tried to open persistent remote access without user action. Cursor removed the version, shut its marketplace, rotated keys, rebuilt the store and had the attacker's server taken down.
Source : Next - « Danger autour d’une extension Claude Code vérolée dans la boutique de Cursor »
What it changes for an SME
If your team uses Cursor with Claude Code, plan time to check workstations: remote access may have been installed on 29 October. Uninstalling the extension is not enough, because a persistence mechanism can survive a reboot. The risk is third-party control of a machine, and computer name, Git email and public IP may have been sent, which also raises data-protection issues. If you do not use this tool, nothing changes immediately, but extension stores for AI coding tools sit in your supplier chain.
What you can do
- Check whether Claude Code extension version 2.1.313 was installed through Cursor on 29 October.
- Look for an SSH key labelled svc-telemetry and unusual startup scripts; uninstalling the extension does not remove remote access.
- If Cursor contacts you, follow its guidance and isolate affected machines until they are checked.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.