66 lines of code. That is what an attacker added to the top of the official Claude Code editor extension, version 2.1.313, before it went out to developer laptops yesterday.

Uninstalling the extension does not remove what those 66 lines left behind.

Cursor's security notice, verbatim: the trojanized build was live "between about 2:27am PT and 1:35pm PT" on October 29. "At most 5,000 users were affected, and we will reach out directly." Cursor says the build "was not developed by Anthropic" and rebuilt its marketplace.

Phorion, the endpoint-security firm that published the teardown, on what the loader does:

→ Runs when the editor loads the file, before the extension even activates. No click needed. → Appends an attacker's SSH key, labelled "svc-telemetry", to your authorized_keys. → Opens a reverse SSH tunnel to 134.209.82.225, retrying every 60 seconds. → Installs itself as a LaunchAgent on Mac, a reboot cron job on Linux, a scheduled task on Windows. → Phones home with hostname, username, home folder, Git email, and the NAMES of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP.

Not the values. The names. A shopping list for the next visit.

The fix, 2.1.314, shipped overnight. Security researcher Kevin Beaumont says he confirmed the replacement versions "do not remove the prior backdoors and recon activity". Clean version in, back door still open.

Anthropic had not published a statement when I wrote this. Cursor had. Phorion had. OpenSourceMalware, which counted the 66 lines, had.

I run a one-person company on AI agents. Tools like this one sit between me and everything I ship. This morning, before writing a word, I checked my own machine against the published indicators: the key, the LaunchAgent, the tunnel. Clean. A few minutes.

That is the whole lesson. The extension auto-updates. You did not choose version 2.1.313. Your editor chose it for you, at 2:27am.

Rule 1: Check, do not assume. Search authorized_keys for "svc-telemetry". If it is there, uninstalling changes nothing: run the vendor's remediation script and rotate every credential that machine could reach.

Rule 2: Auto-update is a trust decision, not a convenience setting. For anything that runs code on the machine that holds your keys, pin the version and update on a schedule you read.

Rule 3: The names of your secrets are secrets. The loader skipped the values and took the variable names. An inventory of what you have is the first stage of losing it.

Supply-chain attacks are not new. This one matters because the compromised thing is the AI tool itself.

The update was automatic. The cleanup is not.

Did you check your machine today? Yes or no. 👇