Updated October 30, 2026. Cursor has warned that a maliciously modified package masquerading as Anthropic’s Claude Code extension was available through its extension marketplace on October 29. The affected package was Anthropic.claude-code version 2.1.313. Cursor says the malicious version was not developed by Anthropic.
What happened and when?
According to Cursor’s October 29 security notice, the modified extension was available from approximately 2:27 a.m. until 1:35 p.m. Pacific Time. Cursor removed it, rebuilt the marketplace and worked with the hosting provider to disable the attacker’s server.
What did the malicious extension attempt?
Cursor says the package collected host information, attempted to append an unauthorized SSH public key, enable SSH, establish a reverse tunnel and install persistence on macOS or Windows. Some steps generally require administrator rights and may have failed, but that does not mean every exposed machine is clean.
How many people were affected?
Cursor estimates that at most 5,000 users were affected. That is not a verified count of machines successfully compromised. The number of successful backdoors and any subsequent access remain unknown. Reuters also reported the disclosure.
How to check your system
If you installed or updated the affected extension from Cursor’s marketplace during the exposure window, check your extension version and review Cursor’s official indicators of compromise. Cursor identifies an unauthorized SSH key comment, svc-telemetry, as one indicator. Its advisory includes platform-specific checks and remediation scripts. A negative check for a single indicator does not replace a complete investigation.
What to do if affected
- Follow Cursor’s official advisory and verify any scripts before running them.
- Isolate hosts showing signs of payload execution or unauthorized access.
- Remove the malicious extension, unauthorized keys, persistence mechanisms and processes; simply uninstalling may be insufficient.
- Rotate accessible credentials and sessions from a trusted device.
- Review endpoint and network logs and consider rebuilding the machine if integrity cannot be established.
What remains unknown?
The initial compromise route, confirmed number of successfully accessed devices and any downstream data theft have not been publicly established. Cursor says it found no evidence that other extension versions were affected.
Frequently asked questions
Is the official Claude Code extension malicious?
No general conclusion of that kind is supported. Cursor’s warning concerns a specific modified package and version distributed through its marketplace.
Is uninstalling version 2.1.313 enough?
Not necessarily. Cursor warns that persistence components may remain after uninstalling.
Illustrative photo: Daniil Komov / Unsplash.
