Cursor Says a Malicious Claude Code Extension in Its Marketplace Affected Up to 5,000 Users
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the t.co/sJRGX5jLXW, Grok Bot, Grok or our other SpaceXSI products. In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk. If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314:
Context
It is a serious supply chain attack on AI coding tools: a tampered extension tried to install a backdoor on developer machines through a trusted marketplace.
Cursor is a popular AI code editor built on VS Code, with its own extension marketplace. Claude Code is Anthropic's coding agent, which also ships as a VS Code extension. A supply chain attack plants malicious code inside software that users trust and install.
Deep dive
Cursor said early Friday that it identified a security incident affecting a modified Claude Code VS Code extension accessed through its Cursor IDE extension marketplace, impacting at most 5,000 users. According to the post, the malicious version was not developed by Anthropic and does not affect other extensions.
Cursor says it took the marketplace down, worked with providers to neutralize the malware and reinstated the marketplace after confirming there was no further risk. It asked all customers to update to Claude Code for VS Code version 2.1.314.
Cursor's security notice, dated October 29, says the tampered package was Anthropic.claude code version 2.1.313, available between about 2:27 AM and 1:35 PM Pacific time that day. It says the code collected host details such as username, operating system, Git email and public IP address, added an attacker's SSH key to the machine, tried to open a reverse SSH tunnel and set up persistence.
Cursor says enabling remote login needs admin rights on most Mac and Windows machines, so the tunnel step would usually fail, and the attacker's server is now offline. It still tells affected users to check for a key labeled svc telemetry, run its cleanup scripts and rotate credentials. Cursor did not say how the package got into its marketplace.
What to expect next
Watch for Cursor's explanation of how the tampered package was published, and whether Anthropic or Open VSX changes how extensions are verified. Affected developers should follow the cleanup steps and rotate credentials. Expect wider scrutiny of extension marketplaces used by AI editors, since coding agents often run with broad access to code and secrets. Security researchers may also publish their own analysis of the payload, which could reveal whether other tools were targeted.