Home · Technology · Nov 3 archive
Cursor Marketplace Tampered Claude Code Extension Affects Up to 5,000 Users
Confirmed
In Short: An official extension for Anthropic’s Claude model was compromised on the Cursor marketplace, potentially affecting up to 5,000 developers’ machines for 11 hours on October 29, 2026.
An official extension for Anthropic’s Claude model was compromised on the Cursor marketplace, potentially affecting up to 5,000 developers’ machines for 11 hours on October 29, 2026.
The tampered version, labeled as anthropic.claude-code version 2.1.313, was published under the legitimate publisher identity and extension ID.
Researchers at OpenSourceMalware discovered that the malicious version contained a 66-line loader inserted before the legitimate extension code.
Microsoft’s security team confirmed that both versions 2.1.313 and 2.1.312 were served through the Cursor marketplace.
The malicious code was designed to survive reboots by setting up a LaunchAgent on macOS or a scheduled task called SysMon on Windows.
Cursor noted that the malicious extension attempted to collect information about the host machine and its user, including public IP addresses through ifconfig.me and api.ipify.org.
Anthropic’s David Dworken stated that the official VS Code and Open VSX channels were not affected, and that the tampered version was published using access to Cursor’s marketplace.
Cursor published remediation steps on Thursday for the affected users, emphasizing the need for a thorough investigation of device activity during the exposure window.
What this adds
The incident highlights the importance of verifying the integrity of software updates and extensions, especially in developer tools.
The compromised extension was not developed by Anthropic, and the company is contacting potentially affected users directly.
Background
An official extension for Anthropic’s Claude model was compromised, potentially affecting up to 5,000 developers’ machines for 11 hours on October 29, 2026.
An official extension for Anthropic’s Claude model was compromised and backdoored, potentially affecting up to 5,000 developers’ machines for about 11 hours on October 29, 2026.
What's confirmed
- Cursor says the bad version was live for roughly eleven hours and reached at most 5,000 users. [1] If you write code with Cursor, check your machine today, because uninstalling the extension does not undo everything it did. [3] Researchers at OpenSourceMalware found that version 2.1.313 of the extension published under the name anthropic.claude-code on the Cursor marketplace carried extra code. [2] Cursor later widened the warning to include version 2.1.312 for Windows and macOS. [1] Microsoft's security team confirmed both versions were served through the Cursor marketplace and said Cursor reported the incident on October 29. [3] The extra code was a 66-line loader placed in front of the real program.
- “Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace,” Cursor said in a security notice.
What's still developing
- Cursor reports that this step often fails on macOS and Windows without administrator rights, but the key is still added. [1] Next, it opens an outbound connection to a server at 134.209.82.225 and asks that server to forward traffic back to your computer's SSH port, a so-called reverse tunnel.
- It runs as soon as the extension loads, so you did not have to open a chat or click anything.
- [3] By Cursor's count, the tampered build went live in the early morning of October 29 Pacific time and was pulled in the afternoon of the same day.
- [2] Errors are hidden, which means the extension kept working as normal while the loader did its job.
- [1] Only people who installed or auto-updated the extension from Cursor's own marketplace in that period are in scope.
- Cursor says the bad version was live for roughly eleven hours and reached at most 5,000 users.
- [3] The extra code was a 66-line loader placed in front of the real program.
- Una versione manomessa dell'estensione Claude Code è stata distribuita per 11 ore sul marketplace di Cursor.
- Eastern on Thursday, October 29, should treat their machines as affected, Ars Technica reported.
- "The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code," Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News.
- According to Stack Overflow’s 2026 Developer Survey, released in early October, Cursor accounted for 26% of the AI coding tools or AI agents used by surveyed developers.