# Cursor reports malicious Claude Code VS Code extension affecting up to 5,000 users

> Original title: grep to check if you are affected:

- Source: Sophia Yang
- Published: 2026-10-30T16:17:50.000Z
- Bad Influence: https://badinfluence.news/items/wogwcxe4cioqhpf22c87lp60i
- Original: https://x.com/sophiamyang/status/2116202930705707519

## Summary

Sophia Yang reposts a Cursor security notice saying a modified Claude Code VS Code extension, distributed through Cursor's extension marketplace, affected at most 5,000 users. Cursor says Anthropic did not develop the malicious version and asks users to update to Claude Code for VS Code version 2.1.314. Yang's own post gives a grep command that checks for an svc-telemetry key in ~/.ssh/authorized_keys.

## Why it matters

The quoted notice gives the affected version, the exposure window, and a grep check, which helps Cursor users verify exposure to the malicious extension.

## Post

grep to check if you are affected: 

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

## Quoted post @cursor_ai

> We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the http://cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.
> 
> In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
> 
> If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: https://cursor.com/blog/claude-code-extension-security-notice

https://x.com/cursor_ai/status/2116074289053175808