Cursor says a tampered Claude Code extension was on its marketplace from about 2:27am to 1:35pm PT on 29 October; Anthropic says its own systems were not compromised

Cursor said in a security notice dated 29 October 2026 that between about 2:27am and 1:35pm Pacific Time that day, a maliciously modified version of Anthropic’s Claude Code extension was available in the Cursor VS Code Extension Marketplace.^[1] The notice names versions 2.1.312 and 2.1.313 for Windows and macOS and says they “were not developed by Anthropic”.^[1] Cursor said it has no evidence that other versions of the extension or the official distribution are affected.^[1] Wired reported that the extension was live for roughly 11 hours and that Cursor, which Wired says is owned by SpaceX, said it was downloaded by “at most 5,000 users”.^[5] Implicator reported that extensions auto-update in Cursor by default and that this one updated itself to the malicious version.^[6]

Cursor said the extension collects host and user details and attempts to install a persistent SSH backdoor.^[1] Cursor said that, outside highly unusual circumstances, an error in the malicious code made a key step fail, and that on most machines the attacker could not have logged in; its notice also says the extension added the attacker’s key, installed persistence and sent host details.^[1] OpenSourceMalware said the malicious code ran when the extension was loaded, with no Claude conversation needed.^[4] Calum Hall, chief executive of the security firm Phorion, which Wired and DoublePulsar say first noticed the activity, said, as quoted by Help Net Security, that the backdoor bug “minimises impact on macOS” but “the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator”.^[5][2][3] Wired quoted Hall as saying “Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker”.^[5]

Cursor said it removed the malicious version when it detected it, shut down the whole marketplace, audited access and confirmed no other extensions were tampered with, rotated its keys, rebuilt the marketplace and brought it back online.^[1] It said it worked with the cloud provider hosting the attacker’s server to take it offline.^[1] Cursor advises anyone who installed or updated the extension in that window on macOS or Windows to run its published check for the attacker’s SSH key, warns that uninstalling the extension may not be enough, and tells affected users to rotate credentials and sessions from a trusted system.^[1] Help Net Security reported that Cursor plans to contact affected users directly.^[3]

Felix Rieseberg, a member of Anthropic’s technical staff, posted on X on Friday 30 October that “it wasn’t a compromise of Anthropic’s systems or employee laptops”, and that a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the extension, which Anthropic did not build or publish, and that the versions on its official channels are not affected and only Cursor users are impacted, as quoted by Wired.^[5] Wired also quoted David Dworken, who works on security at Anthropic, as saying “We were not involved with building, publishing, or hosting this.”^[5] Wired reported that Cursor did not respond to a request for comment on how the upload happened or whether it came from a breach at Cursor, and Implicator reported on 31 October that neither company had explained how the attackers gained control of the account.^[5][6]

Researcher Kevin Beaumont wrote on DoublePulsar that the version was uploaded under Anthropic’s verified account, that Cursor’s wording that it was not developed by Anthropic was “wordsmithing”, and that Anthropic had not informed customers; he also wrote that Anthropic replaced the compromised version with 2.1.314.^[2] Implicator reported that Beaumont and Phorion said the malicious version was distributed through Anthropic’s official account on Cursor, and that as of Friday Anthropic had not issued a public notice to customers.^[6]

Help Net Security first reported that Phorion found the package on Open VSX and later added that Ax Sharma of Manifold Security disputes that.^[3] OpenSourceMalware first thought the package came from the Open VSX registry, then wrote that Cursor told it the compromise was in Cursor’s marketplace.^[4] OpenSourceMalware separately wrote that the npm package, the Open VSX extension and the Microsoft VS Code extension for Claude are not malicious.^[4] OpenSourceMalware also wrote that its understanding is that the compromise was larger than one extension, while Cursor said its audit found no other extensions tampered with.^[4][1]