Oct 30, 2026

Claude Code Extension 2.1.313 Backdoor: How to Check Cursor, Windsurf and VS Code and What to Do

If you use Claude Code inside Cursor, Windsurf, VSCodium or another VS Code-style editor, open your Extensions panel now and check the version of “Claude Code for VS Code”. If it says 2.1.313, or you’re not sure what you were running on October 29–30, 2026, treat the computer as possibly compromised: updating the extension is not enough, because the malicious build leaves a backdoor behind that keeps running after the extension is gone. Version 2.1.314 is the clean current release. This guide walks through the check, the leftover files to look for on Mac, Windows and Linux (no coding needed), and what to do if you find them.

Key facts (checked against the researchers’ reports and the public extension registries on October 30, 2026):

What happened: a build of the Claude Code extension published as anthropic.claude-code version 2.1.313 on the Open VSX registry contained a 66-line malicious loader placed in front of the normal extension code (OpenSourceMalware; Phorion).

What it does: adds an attacker’s SSH key to your account, tries to switch on remote login, opens a hidden tunnel to 134.209.82.225, installs a startup item so the tunnel comes back after a reboot, and sends basic information about your machine to the attacker (OpenSourceMalware).

You didn’t have to use it: the code runs as soon as the editor loads the extension. You did not need to start a Claude conversation (OpenSourceMalware; Phorion).

Where it lives now: Open VSX returns “Extension not found” for 2.1.313, and its current version is 2.1.314, published October 30, 2026 at 01:07 UTC (09:07 Beijing time) (Open VSX API). The Microsoft VS Code Marketplace version list goes 2.1.311, 2.1.312, 2.1.314, and npm has no 2.1.313 either (npm registry).

Not yet known: how the bad build got published, how many machines ran it, and whether any copy outside Open VSX was malicious. Anthropic had not published a statement when we checked.

Who should worry, and who can relax

The confirmed malicious file came from Open VSX, the free extension store used by VS Code-compatible editors such as Cursor and Windsurf (Phorion names both) and VSCodium. Extensions run with the same permissions as the editor and as you, so a bad one can read your files and change settings in your home folder the moment it loads (Phorion).

Here’s how to sort yourself:

Your setup	Risk	What to do
Cursor, Windsurf, VSCodium or another Open VSX editor with the Claude Code extension, auto-updates on	Highest. Your editor may have pulled 2.1.313 automatically.	Do every step in this guide.
Same editors, but you know you were on 2.1.312 or earlier until you got 2.1.314	Low	Update to 2.1.314 and do the quick leftover-file check anyway.
Microsoft VS Code from the official Marketplace	Lower, not zero. The public version history doesn’t list 2.1.313, but OpenSourceMalware filed a precautionary report for that version too.	Check the version and do the leftover-file check.
Only the Claude Code terminal app, the Claude desktop app or claude.ai, no editor extension	Not affected by this file	Nothing to do for this incident.

A missing version number in a store doesn’t prove what happened to it. CellCog, which tracked the registries, points out that it’s equally consistent with the build being pulled or never being an official release (CellCog). What matters for you is simple: did 2.1.313 ever load on your computer?

Step 1: Check which version you have (two minutes)

Open your editor (Cursor, Windsurf, VS Code, VSCodium).
Open the Extensions view from the sidebar (the four-squares icon), or press Ctrl+Shift+X (Windows/Linux) / Cmd+Shift+X (Mac).
Find Claude Code for VS Code by Anthropic and click it. The version number is shown next to its name on the details page.
If it shows 2.1.314 or later, the current file is clean. That doesn’t tell you whether 2.1.313 ran before the update, so keep going to Step 2.
If it shows 2.1.313, close the editor now (don’t just disable the extension) and go straight to Step 2. If you’re on a work computer, tell your IT or security team before you change anything; the researchers recommend saving evidence before cleaning up.

Did 2.1.313 ever run? Your editor keeps each extension in a folder named after its version. In VS Code that folder is ~/.vscode/extensions on Mac and Linux and %USERPROFILE%\.vscode\extensions on Windows (VS Code docs). Other editors keep a similar folder in your home directory (for example a .cursor folder for Cursor). Look for a folder whose name starts with anthropic.claude-code-2.1.313. Editors usually delete old version folders after an update, so not finding it does not clear you. The leftover-file check in Step 2 is the reliable test.

Step 2: Look for the backdoor’s leftover files

The malicious code writes files that stay after the extension is removed. Both research teams list the same names. You can check them by hand without writing code.

On a Mac

Startup item. In Finder choose Go → Go to Folder…, paste ~/Library/LaunchAgents and press Return. Look for a file named com.apple.sysmond.plist. Despite the name it isn’t from Apple; Phorion notes it’s a disguised user startup item that keeps the tunnel running (Phorion).
Hidden scripts. Go to Folder ~/.config, then press Cmd+Shift+. (period) to show hidden files. Look for .smt and .smtk.
Planted SSH key. Go to Folder ~/.ssh. If there’s a file named authorized_keys, open it with TextEdit (right-click → Open With → TextEdit, don’t save changes) and search for svc-telemetry. The researchers advise checking the key fingerprint too, since the comment could be changed; the fingerprint is SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk (OpenSourceMalware).
Remote Login. Open System Settings → General → Sharing and check whether Remote Login is on. If you don’t need it, switch it off. On a normal (non-admin) account the malware’s attempt to switch it on usually fails because of a bug Phorion found, but if Remote Login was already on, or you turn it on later, the backdoor works (Phorion).

On Windows

Scheduled task. Open the Start menu, search for Task Scheduler, open Task Scheduler Library and look for a task called SysMon.
Startup folder. Press Win+R, type shell:startup and press Enter. Look for sysmon.cmd.
Hidden scripts. In File Explorer go to %USERPROFILE%\.config and look for smt.cmd and smtk.
SSH key. Open %USERPROFILE%\.ssh\authorized_keys in Notepad, if it exists, and search for svc-telemetry.
OpenSSH Server. The malware tries to install and start Windows’ OpenSSH Server. In Settings search for Optional features and check whether OpenSSH Server is installed when you never added it. Phorion found a bug that probably stops this step on a standard Windows install, but check anyway (Phorion).

On Linux

Look for ~/.config/.smt and ~/.config/.smtk, an @reboot line in your user crontab that runs .smt, and svc-telemetry in ~/.ssh/authorized_keys. Phorion also found that the cron logic can wipe your existing cron jobs if it runs more than once, so if scheduled jobs went missing, this may be why (Phorion).

Asking your AI agent to check

If you’d rather have an assistant do the looking, use a different, trusted tool than the editor in question (for example Claude Code in the terminal, Codex or the ChatGPT desktop app), and keep it read-only:

“Don’t change or delete anything. On this computer, check whether any of these exist and tell me what you find: ~/Library/LaunchAgents/com.apple.sysmond.plist, ~/.config/.smt, ~/.config/.smtk, files starting with .stk_ in the temp folder, the text ‘svc-telemetry’ in ~/.ssh/authorized_keys, an @reboot crontab entry, a scheduled task named SysMon, sysmon.cmd in the Startup folder, and any running ssh or autossh process connecting to 134.209.82.225.”

The read-only part matters. If you find something, you may want an expert to see it as it is.

Step 3: If you found nothing

Make sure the extension shows 2.1.314 or later.
Restart your computer and repeat the quick check once. The startup items only show their effect after a login.
Keep an eye on the incident. The cause of the bad publish isn’t known yet, so a follow-up statement from Anthropic or Open VSX could change the advice.

Step 4: If you found any of the files

Both research teams are clear on one point: removing the extension alone does not remove the backdoor (Phorion; OpenSourceMalware). In order:

Disconnect the computer from the network (turn off Wi-Fi, unplug the cable). That cuts the tunnel.
Work computer? Stop and call security. OpenSourceMalware advises preserving evidence before removing anything (OpenSourceMalware). Phorion tells organisations to engage incident response wherever the extension was used (Phorion).
Rotate your passwords and keys from a different, clean device. The beacon sends the names of up to 40 environment variables containing words like KEY, TOKEN, SECRET, PASS, AWS or GCP, not their values, but anyone who logged in through the tunnel could read whatever your account can read (Phorion). Start with API keys for AI services, cloud accounts, GitHub and anything saved in files on that machine.
Remove the leftovers: unload and delete the startup item, delete the hidden scripts and temp key files, remove the svc-telemetry line from authorized_keys, and turn off Remote Login or OpenSSH Server if you didn’t set them up.
Consider a clean reinstall. OpenSourceMalware says rebuilding the machine is safer than assuming the known files were the whole story, because an attacker with interactive access could have done more (OpenSourceMalware).

Phorion also explains how to tell whether anyone actually used the backdoor: successful logins through the tunnel show up in your SSH logs as coming from localhost (127.0.0.1 or ::1) using the planted key (Phorion). That’s a job for whoever handles your incident response, not something you need to read yourself.

Why updating isn’t enough, in plain words

The bad build did its work in the first second the editor loaded it, then let the real Claude Code start as normal, so nothing looked wrong (OpenSourceMalware). It left four kinds of things behind:

A key to your door: an attacker’s SSH key added to your account, so they can log in as you if SSH is reachable.
A tunnel: a background connection from your computer to the attacker’s server at 134.209.82.225, which lets them reach your machine even behind a home router. It retries every 60 seconds and keeps running after you close the editor (Phorion).
A startup item: so the tunnel comes back every time you log in.
A check-in message: your computer name, user name, operating system, Git email and public IP sent to the attacker (Phorion).

Updating to 2.1.314 replaces the extension file. It doesn’t touch any of those four.

How to lower the risk next time

This isn’t the first time AI coding tools have been the way in this year. In June the Miasma worm used Claude Code and Cursor config files, and in October a poisoned LiteLLM release stole credentials from developer machines. A few habits help without needing any code:

Know which store your editor uses. Cursor, Windsurf and VSCodium pull from Open VSX, a different store from Microsoft’s Marketplace, so a version can exist in one and not the other.
Think about auto-updates for powerful extensions. VS Code lets you switch off automatic extension updates with the Disable Auto Update for Extensions command or the matching action in the Extensions view (VS Code docs). Waiting a day before taking a new version of an extension with full access to your machine gives researchers time to spot problems like this one. The trade-off is that you also get fixes later.
Keep secrets out of your shell environment where you can. Even names alone told this attacker which machines were worth targeting.
Leave Remote Login and OpenSSH Server off unless you actually use them. On a Mac with Remote Login off, this particular backdoor’s way back in didn’t work (Phorion).
Limit what your agent can touch. That doesn’t stop a malicious extension, but tight permissions limit the damage from agent mistakes. Our guide to Claude Code permissions and auto mode covers the settings, and version 2.1.314 adds a permissions.blockWritesOutsideWorkingDirectories option that stops Claude’s own file edits outside your project folders (Claude Code changelog).

If you mostly use Claude Code to get work done rather than in an editor, our Claude Code daily-driver guide and Claude Code in the cloud cover setups that don’t depend on an editor extension at all.

FAQ

Is Claude Code itself hacked? What’s confirmed is that one extension build, 2.1.313 from Open VSX, was malicious. The extension’s normal files and the bundled Claude Code program in it matched the real ones; only the extension’s main script was changed (OpenSourceMalware). How it got published under the official name isn’t known yet.

I use the official VS Code. Am I safe? Probably, but check. The Marketplace’s public version history skips from 2.1.312 to 2.1.314, and the only file the researchers analysed came from Open VSX. Phorion says 2.1.313 was also pulled from npm and the VS Code Marketplace, so do the two-minute leftover-file check rather than assume (Phorion).

Did it steal my API keys? The automatic check-in sent the names of matching environment variables, not their values. The real risk is the backdoor: if someone logged in through it, they could read anything your account can. If you found the files, rotate keys from another device.

Does the attacker get in if my Mac has Remote Login off? The tunnel can still connect out, but traffic coming back hits a closed door, so the planted key can’t be used while Remote Login stays off (Phorion). Don’t rely on that: the startup item stays and works as soon as Remote Login is switched on.

Should I uninstall Claude Code’s extension? Not necessary if you’re on 2.1.314 and the leftover check is clean. If you found leftovers, follow Step 4 first; removing the extension doesn’t fix them.