機械翻訳 / Machine-translated
@aifriends
AI Friends（https://aifriends.jp）のクロスポスト公式アカウント。AIツールの紹介・使い方・できることを、中学生でもわかるやさしい日本語で届けます。
What would you do if you discovered that a backdoor had been secretly planted in an AI coding tool extension you use every day? On October 29, 2026, that's exactly what happened. This article walks you through what occurred, how to tell if you're affected, and what steps to take.
Cursor (an AI-powered code editor) announced in an official security notice that a fraudulent, tampered version of Anthropic's Claude Code extension had been published on its own extension marketplace.
The fraudulent version was available from 18:27 on October 29 to 05:35 on October 30 (Japan Standard Time) — a window of approximately 11 hours.
The affected versions are Anthropic.claude-code versions 2.1.312 and 2.1.313. Any environment that installed or updated the extension during this period may be impacted.
Security firm Phorion published a detailed analysis on October 30, which brought the issue to widespread attention. In Japan, GIGAZINE covered it on November 2.
According to Cursor, the fraudulent version was not created by Anthropic. It has been reported that an Anthropic representative on Hacker News clarified that neither Anthropic's systems nor employees' computers were compromised, and that the official distribution channel for Claude Code was not affected.
The malicious code was prepended to extension.js, the extension's main file. It ran as soon as the editor loaded the extension — before any normal functionality — without any action required from the user.
According to Phorion's analysis, the malicious code attempted the following in sequence:
authorized_keys file (the list of keys permitted to log in via SSH)For persistence, the malicious code used LaunchAgent on macOS, cron on Linux, and Task Scheduler on Windows. If the tunnel dropped, it attempted to reconnect every 60 seconds.
Additionally, the following information was transmitted to the attacker: the PC's hostname, username, OS type, public IP address, and the email address configured in Git.
Furthermore, the names of up to 40 environment variables that appeared to contain keys or tokens were sent. Phorion noted that no process was observed to send the values themselves.
The fraudulent version used the comment svc-telemetry to label the key it added. This means you can determine whether you were affected by checking whether this string remains in your authorized_keys file.
The verification command provided by Cursor is as follows. On macOS, run this single line:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
On Windows, run the following in PowerShell:
$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }
If the key is found, treat your machine as compromised. Cursor advises disconnecting it from the network, investigating, and then using the provided remediation scripts (remediate-macos.sh for macOS and remediate-windows.ps1 for Windows).
There is an easy-to-miss point: simply uninstalling the extension is not enough. A standalone script left behind by the fraudulent version may continue running even after the extension is removed.
Cursor also recommends considering rebuilding the host. Any credentials or sessions that were accessible from that PC should be rotated from a trusted, separate environment.
There is a range of views on the scale of the impact.
According to Help Net Security, Cursor stated that at most 5,000 users were affected.
Cursor noted that on many macOS and Windows systems, insufficient administrator privileges would cause the SSH service enablement step to fail. Phorion also analyzed that on macOS, a bug in the confirmation logic meant that remote login would not be enabled for standard users.
However, this is no reason to feel reassured. The key registration, persistence setup, and PC information transmission would still execute. Phorion warns that on PCs where remote login was already enabled — or where it is later enabled — the backdoor would remain fully usable.
Consider a typical office worker who opens Cursor every morning to start their workday. On the day the extension silently auto-updated, the SSH key allowing access to their work PC — and potentially company repositories — could have been registered without them ever noticing.
The attacker's server has since been taken offline, but if the key and persistence settings remain, they could be reactivated from a different server. That is why verification is essential.
There was some inconsistency in reporting about which marketplace was the source. Phorion's initial report identified Open VSX (an open-source extension distribution site) as the origin.
Phorion later corrected this to Cursor's marketplace. Help Net Security also noted that this point was not clearly sorted out in some coverage.
Developing a habit of checking primary sources helps avoid this kind of confusion. Reading the statements from Cursor, Phorion, and Anthropic side by side makes it easier to get a clear picture.
This is not the first time VS Code-compatible editor extensions have been targeted. A piece of malware called GlassWorm exploited extension dependencies on Open VSX, with 72 malicious extensions discovered after January 31, 2026 — some of which impersonated AI-assisted tools including Claude Code.
There is a key difference in tactics. GlassWorm involved slipping in fake extensions. This incident involved replacing the official extension itself — making it much harder to catch simply by checking the name.
The number of developers in Japan using Cursor and Claude Code for professional work is growing. Since the fraudulent version was distributed during the late-night and early-morning hours in Japan Standard Time, Japanese users were entirely within the window of potential impact.
Particularly among freelancers and small development teams, individuals often have the freedom to install whichever extensions they choose on their work machines. Administrators may not always have visibility into who installed which version.
IT administrators should start by confirming the following three points:
svc-telemetry remains in any authorized_keys filesGuidance on GlassWorm has identified verifying dependencies and managing an organization-wide extension allowlist as practical countermeasures.
Incidents like this cannot be reduced to zero. Even so, there are steps you can take to minimize potential damage.
First, rather than relying entirely on automatic extension updates, build a habit of checking update dates and changelogs.
Next, review your SSH settings. Simply not enabling remote login on machines that don't need it goes a long way toward making backdoors like this one ineffective.
Phorion recommends monitoring IDE helper processes for any writes to authorized_keys, as this can help you spot unusual activity.
Finally, avoid leaving passwords and API keys in your PC's environment variables indefinitely. In this incident, the names of environment variables that appeared to contain keys or tokens were collected.
A. An Anthropic representative is reported to have clarified that Anthropic's systems were not compromised and that Claude Code through official distribution channels was not affected. The problem was limited to the tampered version distributed via Cursor's marketplace.
A. Cursor's advisory covers macOS and Windows. Phorion's analysis also includes Linux, noting that the malicious code contained logic to set up persistence using cron. If you use Linux, it's worth checking as well.
A. Unfortunately, no. Even after deletion, the SSH key and persistence settings left by the fraudulent version may remain. Run the verification command, and if anything is found, use the remediation scripts to remove it.
A. Cursor has removed the two problematic versions. However, updating does not remove any keys or persistence settings that were already left behind. Anyone who had 2.1.312 or 2.1.313 installed at any point should run the verification command.
A. Phorion confirmed a process that sent environment variable names but did not observe any process that sent their values. However, if the backdoor was actively used, information on the PC could potentially have been accessed. As a precaution, consider rotating any sensitive credentials.
svc-telemetry in authorized_keysStart by running the verification command on your own PC, and share the results with your teammates.
This article is a cross-post from AI Friends.