Claude Code Extension Backdoor: Which AI Keys to Rotate and Which Spend Limits to Check

Updated November 3, 2026 · first published November 3, 2026

On 29 October 2026, a maliciously modified Claude Code extension (versions 2.1.312 and 2.1.313) was served from Cursor's extension marketplace for about 11 hours. Cursor says it tried to install a persistent SSH backdoor. Anthropic did not develop it. If a machine that ran it holds LLM or cloud keys, rotate them and review usage for the exposure window.

Published 3 November 2026 · facts from Cursor's security notice (29 October, updated 30 October) and Help Net Security (30 October)

What happened?

• Window: per Cursor, the modified extension was available from about 2:27 am to 1:35 pm Pacific on 29 October 2026. Cursor removed it, blocked distribution, shut the marketplace down as a precaution, rebuilt it and brought it back.
• Who built it: Cursor says the malicious versions “were not developed by Anthropic” and that it found no evidence other versions or the official distribution were affected. How the attacker published under the legitimate extension's identity was still unclear in press reports on 30 October.
• Platforms: Windows and macOS builds, per Cursor.

What did the malicious code do?

From Cursor's notice: it collected host and user details (hostname, username, operating system, architecture, home directory, environment variable names, working directories, Git email and public IP). It tried to add an attacker-controlled SSH key labelled svc-telemetry, enable the local SSH service, open a reverse SSH tunnel, and persist through a macOS LaunchAgent or a Windows scheduled task, retrying about every 60 seconds. Enabling SSH needs administrator rights the extension usually lacks, so that step probably failed on most machines, but the key, persistence and host details were still sent, so cleanup is still required. Cursor says the attacker's server is offline.

Help Net Security adds that the code collected the names, not the values, of up to 40 environment variables that look like keys, tokens, passwords or AWS and GCP credentials. Cursor notes that this limited collection does not rule out credential access later, and that uninstalling the extension “may not be sufficient.”

Why an AI-spend owner should care

A developer laptop is where LLM provider keys, cloud AI credentials and agent tokens usually live, often in shell profiles, .env files and environment variables. A key-name list tells an attacker which of those exist. A stolen provider key does not need a breach of the provider: it can be used to run up usage on your account. That is the cost side of this incident. We have no evidence that any key from this incident was abused. The point is to treat the exposure window as a bounded period you can check. For how key theft turns into spend, see LLM API billing account hijacking and the economics of agent intrusions.

What to check, in order

1. Were you exposed? Did anyone install or update Anthropic.claude-code 2.1.312 or 2.1.313 from Cursor's marketplace on 29 October? Check ~/.ssh/authorized_keys for an entry labelled svc-telemetry. Cursor publishes platform check and remediation scripts in its notice.
2. Isolate and clean. Remove the unauthorized key, the persistence entries and any tunnel processes, and decide whether to rebuild the machine. Do the rest from a trusted system.
3. Rotate every secret that machine could read: LLM provider keys (Anthropic, OpenAI, Google), cloud AI credentials (Bedrock, Vertex, Azure OpenAI), gateway and proxy tokens, tool and MCP server tokens, CI/CD secrets, and Git credentials.
4. Review usage for the window and after. For each rotated key, compare token use and spend from 29 October to today against its normal pattern: new models, new regions, off-hours spikes, a sudden change in request volume. See the LLM cost spike runbook.
5. Confirm the old keys are dead. Revoke, do not just replace, and check that no process still uses the old value.

Controls that limit the damage next time

• One key per developer or service, scoped to a workspace, so one theft cannot spend the whole account.
• Spend limits and alerts per key. A rate or budget cap turns a stolen key into a bounded loss. See rate limits are cost control.
• Short-lived credentials from a secrets manager or federation instead of long-lived keys in shell profiles.
• Treat IDE extensions as software supply chain. Pin versions, delay automatic updates for a short period, and allow-list publishers. These are our recommendations, not steps from Cursor.

What is still unclear

• Scale. Help Net Security reports Cursor said at most 5,000 users were affected. Cursor's own notice does not state a number.
• Versions and marketplaces. Cursor's notice names 2.1.312 and 2.1.313; Help Net Security's report describes 2.1.313. One researcher reported the package on Open VSX; another disputes that and says it was the official extension in Cursor's marketplace.
• How the attacker published it. Not explained in the sources we read.

Do not confuse it with the July report

In July 2026 China's Ministry of Industry and Information Technology said Claude Code versions 2.1.91 to 2.1.196 contained a “security back-door vulnerability”. Anthropic told CNBC the “backdoor” was an experiment earlier this year meant to protect against distillation. That is a different matter from the October extension attack, which involved modified copies in a marketplace, not Anthropic's own release.

Related

• LLM API billing account hijacking
• The economics of AI agent intrusions
• LLM cost spike runbook
• Rate limits are cost control

Want this applied to your stack? Bring the provider bills, gateway logs, and top workflows; we will map the cost drivers and savings path. Book a free audit →

Back to finopsllm.com