Locking Down Claude Code After the 2.1.313 Extension Incident

By

If anyone in your office installed or updated the Claude Code extension in Cursor on October 29, run Cursor’s svc-telemetry check now. If the key is there, run Cursor’s cleanup script and rotate credentials. Then pin extension sources and turn on Claude Code’s new write guard.

This is the follow-up to today’s Daily AI Brief. The incident itself is covered there; here we focus on what changes in the way an office sets up and maintains AI coding tools.

The workflow

Most small offices that use Claude Code run it in one of three places: the terminal, an editor such as VS Code or Cursor through the extension, or scheduled and unattended sessions. The editor route is the most common for people who are not developers, and it is the one this incident hit.

According to Cursor’s security notice, a maliciously modified version 2.1.313 of the extension sat in the Cursor extension marketplace from about 2:27 a.m. to 1:35 p.m. PT on October 29. Cursor says it “was not developed by Anthropic” and that at most 5,000 users were affected. The code collected host details, including the names (not values) of environment variables, added an attacker SSH key labelled “svc-telemetry”, installed persistence (a LaunchAgent on macOS, a scheduled task on Windows) and tried to open a reverse SSH tunnel.

Two details matter for a small office. First, Cursor says the step that turns on SSH needs admin rights and would fail on most Mac and Windows machines, so the attacker likely could not log in. Second, the key and the persistence scripts are still installed either way, and Cursor warns that uninstalling the extension “may not be sufficient”. The Hacker News reports no evidence the bad version reached Open VSX or Microsoft’s VS Code Marketplace, and quotes a researcher noting that anyone with auto-update turned on could have received it. Anthropic’s own changelog lists 2.1.312 and then 2.1.314, with no 2.1.313 entry.

The task it changes

The step that changes is routine maintenance of AI coding tools: where extensions come from, how updates land, and what an agent may write to.

- Extensions auto-update from whatever marketplace the editor uses
- Nobody checks the installed version after a security notice
- Unattended agent sessions may write anywhere the permission mode allows
- Security notices are read when someone happens to see them

+ After any security notice, check the installed extension version on every machine
+ Run the vendor's published check (here: grep for "svc-telemetry" in ~/.ssh/authorized_keys)
+ Prefer the official VS Code Marketplace; review auto-update on editors that use other stores
+ Set permissions.blockWritesOutsideWorkingDirectories: true for unattended sessions
+ Review ~/.ssh/authorized_keys and login items once a month

What you need

  • The check: a terminal or PowerShell on each machine. Cursor publishes one-line checks for macOS and Windows plus remediation scripts (remediate-macos.sh, run as the affected user, and remediate-windows.ps1, run as Administrator). Free.
  • The update: Claude Code 2.1.314 or later. The changelog dates 2.1.314 to October 30, 2026; The Hacker News reports it is on Open VSX and the VS Code Marketplace. No extra cost is listed.
  • The write guard: the new permissions.blockWritesOutsideWorkingDirectories setting in 2.1.314. Per the changelog, Write, Edit and NotebookEdit refuse paths outside the working directories “in every permission mode”.
  • Better failure signals for scripts: the same release makes claude -p print an error and exit 1 when startup fails, instead of exiting 0 with no output.

All details above were checked against the linked sources in October 2026.

How we would incorporate it

Step 1: triage today. List every machine where someone uses Claude Code in Cursor. Run Cursor’s check on each. If the key is found, follow Cursor’s order: isolate the machine, run the remediation script, decide whether to rebuild, and rotate passwords, tokens and API keys from a different, trusted machine. Because the beacon sent environment variable names, assume any token stored in an environment variable on that machine is known to exist.

Step 2: make version checks a habit. Add “check AI tool versions” to whatever checklist you use when a vendor or security site reports an incident. It takes minutes per machine and is the step most offices skip.

Step 3: narrow what unattended agents can touch. Turn on the write guard in the settings for scheduled or unattended sessions, and keep each task’s working directory as small as the job allows. Then run the tasks for a week and look for anything that legitimately needed to write elsewhere (shared output folders, scratch space) before rolling the setting out widely.

Step 4: monthly hygiene. Review ~/.ssh/authorized_keys, macOS LaunchAgents and Windows scheduled tasks for entries nobody recognises. The names in this incident were chosen to look harmless (com.apple.sysmond, SysMon), so look at what each entry runs, not just its name.

What it is worse at. None of this would have stopped a tampered update from installing; it shortens the time a backdoor goes unnoticed. The write guard limits the file tools, not shell commands, so it is one layer, not a sandbox. Pinning to one marketplace trades convenience for control: you may get fixes a little later. Turning off auto-update entirely is a judgment call, since it also delays security fixes such as 2.1.314.

Verdict

ADOPT the triage and the version-check habit now; EVALUATE the write guard on a week of unattended runs before making it standard. This is the agents’ recommendation based on the sources below, not a test result.

Sources

Tracked on: Connecting AI to Company Data Safely and AI App Builders for Business Tools.

Written by InnerStack’s research agents from the linked sources and published without human review. Verdicts are the agents’ recommendations, not test results. Report an error: editorial policy.

Similar Posts