Cursor Now Says Two Tampered Claude Code Extension Versions Were on Its Marketplace, Reaching Up to 5,000 Users
Updated Nov. 2: Cursor's security notice, updated October 30, now names two malicious versions of Anthropic's Claude Code extension, 2.1.312 and 2.1.313, for Windows and macOS; our original report named only 2.1.313. Cursor says the versions were not built by Anthropic, were on its VS Code extension marketplace for about 11 hours on October 29 and tried to install a persistent SSH backdoor. Cursor says at most 5,000 users were affected, it rebuilt the marketplace, and the attacker's server is offline.
Updated November 2, 2026: Cursor's security notice now names two malicious versions of the extension, not one. The new section directly below covers it; the original report follows unchanged.
November 2: a second malicious version#
Cursor says it updated its notice on October 30 at 11:30 a.m. Pacific time to revise its indicators and clarify the affected versions. The notice now lists versions 2.1.312 and 2.1.313 of the Anthropic.claude-code package for Windows and macOS; our original report, below, named only 2.1.313. Cursor says neither version was developed by Anthropic, and it publishes separate file hashes for each.
Cursor's advice now covers anyone who installed or updated to either version from its marketplace on macOS or Windows between 2:27 a.m. and 1:35 p.m. Pacific time on October 29, and it says the same modified code appears in both. The notice we read on November 2 gives no user count; the figure of up to 5,000 users is Cursor's, as reported by Reuters on October 30.
Limits of the November 2 update#
- Cursor gives one time window for both versions and does not say when each was published or how many users installed each.
- The version list is Cursor's own; we found no independent analysis of either package.
The incident shows the attack surface that comes with installing AI coding agents as editor extensions: a counterfeit build of a trusted agent can reach thousands of developer machines within hours. Cursor, which Reuters describes as owned by SpaceX, said a maliciously modified version of Anthropic's Claude Code extension was available on its VS Code extension marketplace on October 29, affecting up to 5,000 users.
What Cursor says happened#
In a security notice, Cursor says version 2.1.313 of the Anthropic.claude-code package was live on its marketplace between about 2:27 a.m. and 1:35 p.m. Pacific time on October 29, and that it "was not developed by Anthropic." Cursor says the code collected host and user details such as hostname, username, operating system and public IP address, and tried to set up remote SSH access for the attacker.
Cursor says one key step would fail on most macOS and Windows machines because it requires administrator rights, so the attacker could not have logged in through the tunnel on those hosts. It says the extension still added the attacker's key, installed persistence and sent host details, and it published checks and remediation scripts for affected users. Cursor says it worked with the hosting provider to take the attacker's server offline.
What Cursor did#
Cursor says it removed the version on detection, shut down the whole marketplace as a precaution, rotated its keys, rebuilt the marketplace and brought it back online. It says it audited access and found no other extensions had been tampered with, and that it has no evidence other versions or the official distribution were affected. Reuters reported the disclosure on October 30 and said Anthropic did not immediately respond to a request for comment.
Limits#
- The timeline, the 5,000-user ceiling and the technical findings are Cursor's own; Cursor has not said how the tampered package got onto its marketplace.
- Reuters' report repeats Cursor's account; we found no independent forensic analysis of the package.
- We have no comment from Anthropic.