---
title: Tip: treat editor extensions as code with your permissions; alert when an editor process writes to authorized_keys or creates login items | ctxsec
url: https://ctxsec.com/items/tip-alert-on-editor-processes-writing-authorized-keys
description: ""
status: "guidance (based on the Cursor Claude Code 2.1.313 incident, Oct 29)"
published: 2026-10-30
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-alert-on-editor-processes-writing-authorized-keys.md)

guidance (based on the Cursor Claude Code 2.1.313 incident, Oct 29)

2026-10-30

### Tip: treat editor extensions as code with your permissions; alert when an editor process writes to authorized_keys or creates login items

The Oct 29 Cursor marketplace incident ran from a normal-looking extension update under the real publisher name. A few cheap controls catch this class:

- Alert on any IDE/Electron/Node child process that writes `~/.ssh/authorized_keys`, creates a LaunchAgent, a scheduled task or a crontab entry.
- On developer machines that do not need inbound SSH, keep Remote Login / sshd off and have your MDM enforce it; the backdoor's tunnel was useless where SSH could not be enabled.
- For teams, pin approved extension versions and delay auto-updates for high-privilege extensions (coding agents, remote dev) by a day so a bad release can be pulled first.
- Keep long-lived cloud keys out of shell environment variables on dev boxes; the implant listed secret-looking variable names to pick targets.

Sources: [Cursor: Security notice, malicious Anthropic.claude-code 2.1.313 in the Cursor Extension Marketplace (Oct 29)](https://cursor.com/blog/claude-code-extension-security-notice)