Cursor discloses malicious Claude Code extension in its marketplace (up to ~5,000 users)
Cursor confirmed Anthropic.claude-code 2.1.312/2.1.313 on its VS Code marketplace were maliciously modified (not by Anthropic) and tried to install an SSH backdoor; the marketplace was taken down, rebuilt, and restored, with remediation steps for affected users.
On 29 October 2026, Cursor published a security notice: between about 2:27am–1:35pm PT that day, maliciously modified Anthropic.claude-code versions 2.1.312 and 2.1.313 (Windows/macOS) were available in the Cursor VS Code Extension Marketplace. Cursor states these packages were not developed by Anthropic, and other marketplace extensions plus Grok Bot, Grok, and other SpaceXSI products were unaffected.
The malware collected host/user details and attempted to add an attacker SSH key, enable local SSH, open a reverse tunnel, and persist. On most hosts where Cursor was not started with admin rights, enabling the SSH service would fail. Cursor removed the packages, briefly shut down and rebuilt the marketplace, and worked with the cloud host to take the attacker server offline.
Users who installed or updated to those versions from the Cursor marketplace in that window should follow the official notice to check for the svc-telemetry key, run remediation scripts, and rotate credentials as needed. Cursor also asks customers to update Claude Code for VS Code to 2.1.314.