Understand this story
Cursor disclosed that a tampered Claude Code VS Code extension appeared in its IDE extension marketplace, affecting up to 5,000 users, and stated that the malicious version was not developed by Anthropic. Cursor took the extension marketplace offline the same day, worked with the relevant service providers to remove the malware, and after confirming there was no further risk, restored it online, while requiring all users to upgrade to Claude Code for VS Code version 2.1.314.
AI-generated from public reports
Latest update · Discussion
The Decoder joined this discussionDevelopments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 31
The DecoderRelated discussion
The Decoder joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
Oct 30
Solidot
Backdoor implanted in official Claude Code for VS Code extension on Cursor Marketplace
Security researchers discovered a backdoor in the official Claude Code for VS Code extension on Cursor Marketplace. The affected version is Anthropic.claude-code 2.1.313, which was online for about 11 hours and is estimated to have affected about 5,000 users. The malicious extension collects information such as hostname, username, operating system, environment variables, Git email, and public IP; attempts to add attacker-controlled SSH keys to authorized_keys, enable the local SSH service, and establish a reverse SSH tunnel; and also uses a LaunchAgent or scheduled task to keep the tunnel active long-term, retrying about once every 60 seconds. Due to a bug in the malicious code, the SSH key implantation step will fail unless Cursor is launched with administrator privileges. This version has been taken down, Cursor has published a security advisory, and Anthropic has not yet made a statement; users who installed or updated to this version between 2:27 AM and 1:35 PM Pacific Time on October 29, 2026 need to check their systems.
NumeramaRelated discussion
Numerama joined this discussion
This post contributes to heat; it is not a formal report or confirmed fact.
CursorFirst-partySelected
Tampered Claude Code extension appears in Cursor extension marketplace, affecting up to 5,000 users
Cursor said that a tampered Claude Code VS Code extension appeared in its IDE extension marketplace, affecting up to 5,000 users; the malicious version was not developed by Anthropic. Cursor took down the extension marketplace the same day, worked with relevant service providers to remove the malware, and after confirming there was no further risk, restored it online and required all users to upgrade to Claude Code for VS Code version 2.1.314.
Heat trend for this story
- Current
- 21
- Period peak
- 25 Oct 31 03:00
- 24-hour change
- —
Move the pointer or select the chart to inspect hourly heat. Use the left and right arrow keys with a keyboard.