How-To: Check Your Machines for SSH Keys You Didn’t Add

The fake Claude Code extension on Cursor dropped a key labeled svc-telemetry into authorized_keys. That’s a good excuse to check every key on every box.

1. Look for the known bad key

grep -n svc-telemetry ~/.ssh/authorized_keys* 2>/dev/null

If it shows up, follow Cursor’s remediation steps: isolate the machine, remove persistence, rotate credentials.

2. List every key with its fingerprint

ssh-keygen -lf ~/.ssh/authorized_keys

Each line shows the size, fingerprint and comment. Anything you can’t match to a device you own is a problem.

3. Check for new persistence on a Mac

ls -lt ~/Library/LaunchAgents | head

Look for anything dated October 29 that you didn’t install.

4. Keep it that way

My rule is that server changes go through Ansible. Its authorized_key module has an exclusive option that removes any key not in the playbook on the next run. Hand edits don’t stick, and neither do an attacker’s.

Review before you run anything: read the docs yourself, back up your config, and try it somewhere you can afford to break first.

God Bless, and Use the Source!

References & Further Reading

• Cursor security notice: malicious Anthropic.claude-code 2.1.313
• ssh-keygen(1) man page
• ansible.posix.authorized_key module (Ansible docs)