Malicious Claude Code builds planted in Cursor extension marketplace after access key exposed at Fireworks; some customer credentials and support data also stolen

In a Nov 13 incident update, Cursor said an attacker obtained an access key Cursor had issued to AI inference vendor Fireworks, copied coding-agent traces from a shared storage bucket, used unredacted credentials in them to reach several SaaS tools, and on Oct 29 used a stolen credential to place unauthorized malicious copies of Anthropic's Claude Code extension on the cache serving the Cursor VS Code extension marketplace ^[1]. Cursor said malicious versions 2.1.312 and 2.1.313 were available for about 11 hours and reached at most 5,000 users, running code that attempts to install a persistent SSH backdoor, while the Open VSX source and Anthropic's official extension were not affected ^[1][2]. What to do now: Cursor asks macOS/Windows users who installed or updated to Anthropic.claude-code 2.1.312 or 2.1.313 from its marketplace on Oct 29 to run its script to check for the "svc-telemetry" SSH key, isolate affected hosts and remove persistence, then rotate credentials and sessions from a trusted system, noting that uninstalling the extension alone may not be enough ^[1][2].

Industries mainly affected: Technology

1. If you installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code extension marketplace on Oct 29, 2026 (about 2:27am–1:35pm PT), run Cursor's check for an SSH authorized_keys entry labeled "svc-telemetry" ^[2].
2. Search endpoint, network and extension-installation telemetry for Cursor's published IOCs, such as 134[.]209[.]82[.]225 ^[2].
3. Isolate hosts showing evidence of payload execution or backdoor installation ^[2].
4. Remove the unauthorized SSH key, persistence mechanisms and running tunnel processes, using Cursor's macOS/Windows remediation scripts, and assess whether to rebuild the host; uninstalling the extension alone may not be enough ^[1][2].
5. Rotate credentials and sessions accessible from affected hosts, from a trusted system ^[2].