Remove the extension and the persistence and the attacker's key may stay behind. Cursor puts it more gently: uninstalling may not be sufficient.
Fact
The facts: on October 29, 2026 Cursor published a security notice: between about 2:27am PT and 1:35pm PT the same day a maliciously modified version of Anthropic's Claude Code extension (Anthropic.claude-code 2.1.313) was available in Cursor's extension marketplace. Cursor says this version was not developed by Anthropic. Per Cursor at most 5000 users were affected, and the company will reach out to them directly. By Cursor's description the version collects data about the machine and the user, tries to add an attacker SSH key, open a reverse SSH tunnel and persist: through a LaunchAgent on macOS, through a scheduled task and the Startup folder on Windows. The key carries the comment svc-telemetry. The attacker's server no longer functions, Cursor says, but uninstalling the extension may not be sufficient. Cursor also says it audited access and confirmed no other extensions were tampered with, and that it has no evidence other versions of the extension or the official distribution are affected. Cursor provides cleanup scripts for macOS and Windows.
Anthropic's name is on the extension, but Anthropic did not write this version. The trust you install it on is trust in a chain: marketplace, publisher, version number. Here one link is broken, and you cannot see which.
There is no CVE number and there should not be one: this is not a bug in Claude Code's code, but a tampered version in a marketplace. So the source here is the marketplace operator, which is Cursor.
The publisher's name on the extension does not tell you who wrote the version.
From 2:27am to 1:35pm is about 11 hours - our own arithmetic from the two times in the notice. How the version got into the marketplace, Cursor does not say. It does not say who is behind it, or how many machines actually carry the key. 5000 is a ceiling, not a count.
My opinion: an editor extension is a program that runs with your permissions, not an add-on. And every update is a fresh install.
If you updated Claude Code in Cursor on October 29 during those hours: check for the svc-telemetry key, isolate the machine, run Cursor's cleanup script and change the passwords and keys the machine can reach. Change them from another, clean machine.
Official primary sources
Cursor security notice (Anthropic.claude-code 2.1.313)The visual is generated code-art, no third-party images.