Updating a Claude Code extension does not necessarily remove SSH keys or startup tasks it has already written to your computer. In the Cursor incident, recovery extends beyond the package to the developer account and operating system.
Cursor's security notice identifies an October 29 distribution window of approximately 02:27–13:35 PT. Crucially, its October 30, 11:30 PT update names both Anthropic.claude-code 2.1.312 and 2.1.313 on macOS and Windows. An inventory based only on the early 2.1.313 briefing could miss relevant installations. This article reviews the updated notice; no malicious package was downloaded or executed.
The trust boundary before the model's approval prompt
An extension is executable code loaded by the editor. It is not a command generated by a model. Instructions against changing SSH settings, or approval requirements for model tools, cannot establish the integrity of the software enforcing those rules.
Cursor describes host information collection, an attacker SSH key, attempted SSH service activation and a reverse tunnel, and operating-system persistence. For environment variables, it specifies collection of names. That does not establish theft of every secret value, nor does it rule out later access.
These operations cross different permission boundaries. Writing user-owned files and enabling a system service are separate capabilities. Cursor says code errors and privilege requirements would prevent the SSH connection stage on most hosts, while still directing users to remediate keys, persistence and host-information transmission. Running without administrator privileges is not sufficient evidence to skip investigation.
Match each decision to the evidence available
This table translates the notice into an investigation record. It is CodeBridge's operational interpretation, not a forensic finding or a replacement for the official cleanup tools.
| Established fact | What it does not establish | Evidence or action needed next |
|---|---|---|
| The installed version has changed | Whether the malicious package ran during the window | Installation/update history, platform and distribution source |
| Either named version was installed in the window | Whether installation progressed to payload execution | Compare package, endpoint and network records with the current IOCs |
The svc-telemetry key or persistence is present |
Whether an attacker connected or what was accessed | Isolate hosts with execution evidence; apply official remediation and assess rebuilding |
| Cleanup exits successfully | Whether credentials or sessions were accessed earlier | Rotate accessible credentials and sessions from a trusted system |
A laptop no longer showing 2.1.313 can remain in scope if its automatic-update history records the installation. Conversely, a version string alone does not establish equivalent exposure across different platforms and sources. Package hashes also differ by platform. Retain version, platform, source, installation time and artifact hash together, including the time zone.
An absent key marker is an observation about the current file, not a complete execution history. Keep installation records and other IOCs available for endpoint investigation instead of turning one negative string search into a clean bill of health.
Why uninstalling is an incomplete recovery model
Removing a package changes what the editor can load next. It does not necessarily remove processes or persistence already created outside that package. Taking the attacker's server offline disrupts a communication path; it does not roll back every affected computer.
If your installation history meets the conditions, start with the notice's current assessment and remediation instructions. Cursor distinguishes running its macOS script as the affected user from running the Windows script in administrator PowerShell. Review the current instructions and script before execution. No host assessment or cleanup was performed for this article.
The early briefing's “up to 5,000” must not become a count of proven remote logins or stolen credentials. The updated English notice inspected here no longer contains that estimate, and we have no independent dataset establishing a confirmed compromise count. Report potentially exposed installations, detections and successful intrusions separately.
Treat the development environment as a deployment artifact
The useful addition to a team's controls is extension distribution history. An approved extension ID alone cannot distinguish a tampered artifact under that ID. Retain source, version, platform and hash, with enough deployment inventory to locate installations when a package is withdrawn.
Review the authority to install the agent environment alongside the authority given to the model. Our agent sandbox guide discusses the latter. This incident exposes a separate verification problem in the editor and extension distribution path. The evidence reviewed here does not establish the full entry mechanism or final scope of the incident.
The published paid course below covers Claude Code tools, permissions and verification workflows. It is not presented as specialist incident-response training or a lab for this compromise. The link is promotional.