Cursor AI, a code editor company, reported a security incident Friday involving a malicious version of Anthropic’s Claude Code, which affected over 5000 user accounts on the platform.
According to Cursor, the security incident involved a tampered build of the Anthropic.claude-code VS Code extension, version 2.1.313, that appeared in its extension marketplace. The company stated that this malicious package was not developed by Anthropic. It was available for roughly 11 hours, from approximately 2:27 a.m. PT to 1:35 p.m. PT, and may have reached at most 5,000 users.
The malicious extension attempted to collect a range of information from affected systems, including hostnames, usernames, operating systems, home directory paths, environment variable names, working directories, configured Git email addresses and public IP addresses. It also attempted to add an attacker-controlled SSH key to users’ authorised keys files, enable local SSH access and establish a reverse SSH tunnel. Cursor said errors in the malicious code meant the remote-access step would fail on most systems because it required administrator privileges.
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the https://t.co/sJRGX5jLXW, Grok Bot, Grok or our other SpaceXSI products.
In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: https://t.co/ESqf7YEtHZ
— Cursor (@cursor_ai) October 30, 2026
Cursor said the package extension runs malicious code that attempts to instill a persistent SSH backdoor and collects hosts and user information including Git email among other activities.
“Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor,” read a statement by Cursor.
The company informed that they have removed the malicious version from the marketplace and blocked further distribution. Currently, it is auditing access and have confirmed that no other extensions were tampered with.
Cursor said it had taken the attacker’s server offline, rotated its own keys, rebuilt the extension marketplace and brought the service back online after auditing it for further compromises. The company warned that simply uninstalling the malicious extension might not be sufficient, as the malware could leave behind persistence mechanisms that continue running independently.
Cursor has advised Users who installed or updated to version 2.1.313 from the Cursor marketplace during the exposure window to check for the “svc-telemetry” key in their SSH authorized_keys files.
Also Read: OpenAI to Cut Off Cursor AI Models After SpaceX Acquisition
