Malicious Extension in Cursor VS Code Extension Marketplace
What happened
A maliciously modified version of Anthropic's Claude Code extension was made available in the Cursor VS Code Extension Marketplace, attempting to install a persistent SSH backdoor, as stated:
AI summary of accepted evidence. Check the original sources for the full context.
Reported impact
An affected population has not been established in the accepted evidence.
- Data access
- exfiltrated
Guidance from the sources
- If you installed or updated to Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code Extension Marketplace on macOS or Windows between 2:27am PT and 1:35pm PT on October 29, 2026: Run the attached script to validate if you are impacted.
Source evidence
5Read the original reporting and statements. Multiple articles may rely on the same underlying source.
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users.
Original statement
3 more excerpts
Attackers backdoored the official Claude Code VS Code extension being distributed on the Cursor Marketplace.
Original statement
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users.
Attributed reporting
A malicious actor used access to Cursor's marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing or hosting this,
Attributed reporting
Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · Cursor
Retrieved 5 Nov 2026
Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace.
Original statement
4 more excerpts
The extension runs malicious code that attempts to install a persistent SSH backdoor.
Original statement
Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.
Original statement
If you installed or updated to Anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor VS Code Extension Marketplace on macOS or Windows between 2:27am PT and 1:35pm PT on October 29, 2026:
Original statement
Today we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace:
Original statement
The Register03Anthropic: That Claude Code extension compromise… couldn't be us
Published 30 Oct 2026Retrieved 4 Nov 2026
A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish.
Attributed reporting
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users.
Attributed reporting
1 more excerpt
A malicious actor used access to Cursor's marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing or hosting this,
Attributed reporting
at most 5,000 users were affected
Original statement
Updates and corrections
All times UTCRevision 12
Source evidence updated.
Revision 11
Guidance updated
Revision 10
Source evidence updated.
Revision 9
Source evidence updated.
Revision 8
Source evidence updated.
Revision 7
Disclosure date revised. Guidance updated
Revision 6
Source evidence updated.
Revision 5
Disclosure date revised
Revision 4
Source evidence updated.
Revision 3
Source evidence updated.
Revision 2
Source evidence updated.
Revision 1
Incident published