Cursor says a tampered Claude Code extension was on its marketplace for part of 29 October

Cursor's notice, dated 29 October 2026, says a maliciously modified copy of the extension Anthropic.claude-code, versions 2.1.312 and 2.1.313 for Windows and MacOS, was available in the Cursor VS Code Extension Marketplace between about 2:27am PT and 1:35pm PT that day. Cursor says those versions were not developed by Anthropic. It says the extension runs code that attempts to install a persistent SSH backdoor: it collects host and user information, tries to add an attacker-controlled SSH key, tries to enable the local SSH service, and tries to open a reverse tunnel. Cursor says that on most macOS and Windows hosts the step that turns on the local SSH service fails, because it needs administrator rights the extension does not have, and that the attacker could not have logged in through the tunnel on those hosts. It also says the extension added the attacker's key, installed persistence, and sent host details.

Cursor says it removed the malicious version, then shut the marketplace down, rotated keys, rebuilt the marketplace and brought it back online. It says it worked with the cloud provider hosting the attacker's server to take that server offline. It says it has no evidence that other versions of the extension, or the official distribution, were affected, and that other extensions downloaded from the Cursor marketplace were not affected. The notice includes checks and remediation steps for machines that installed either version from that marketplace during the window.

What it means for business: this is a company security notice, not a regulator's finding. A firm whose staff install extensions from the Cursor marketplace should check whether those two versions were installed on 29 October 2026 between the times above, and use the steps on Cursor's page. Cursor says Anthropic did not develop the malicious versions.