Cursor pulls a fake Claude Code update that planted SSH keys

The package slipped an attacker’s SSH key (the credential that lets someone log in to a machine remotely) onto each computer, Cursor says, together with start-up scripts that retried a hidden connection to the attacker, called a tunnel, about every 60 seconds and sent the machine’s details back. Bugs in the code and missing administrator rights stopped that connection on most machines, but the key and the start-up scripts still landed, and Cursor warns that uninstalling the extension may not be enough because the scripts keep running on their own. Cursor shut, rebuilt and re-keyed its marketplace.

Microsoft’s threat intelligence team says the doctored versions never appeared on its own VS Code Marketplace or on npm, and that Anthropic told Microsoft its systems were not breached.

Claude Code comes with Claude Pro at $20 a month on our 1 November check, and the setup page for Meta’s ads MCP connector (a standard that plugs AI assistants into other software), which we read on 26 September, lists Claude Code among four agents that can work on Meta ad accounts.

The key and the start-up scripts outlive the extension, so anyone who installed or updated Claude Code through Cursor on 29 October has two jobs left after uninstalling it: run Cursor’s check for the planted key, labelled svc-telemetry, and its clean-up script.