Skip to content
Escape
Meridian

The future is still open.

· Oct 29, 2026

Cursor reports malicious Claude Code extension versions in its marketplace

Markdown · JSON · Original source

says malicious versions of ’s Code extension, 2.1.312 and 2.1.313, were available in the Cursor VS Code Extension for Windows and macOS on October 29, 2026. Cursor says the versions were not developed by Anthropic and were available between 2:27am PT and 1:35pm PT. According to Cursor, the modified extension collected host and user details and tried to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel. Cursor says errors in the malicious code meant the tunnel step would fail on most hosts without administrator privileges, but the extension still added the key, installed persistence, and sent host details. The attacker server is now offline, according to the notice. Cursor says it removed the versions, shut down and audited the marketplace, rotated its keys, rebuilt the marketplace, and brought it back online. It advises people who installed either version during the affected period to check for indicators, investigate affected hosts, remove persistence, and rotate credentials accessible from those hosts. Uninstalling the extension may not be enough because standalone persistence scripts can keep running. How many people installed the affected versions, and how many hosts were compromised? Cursor’s notice does not say.

Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.

CursorArticle · cursor.comOpen original source

Original source

· Article

Source details

Original source date: Oct 29, 2026 (2026-10-29T12:00:00.000Z).

Date basis: Date stated by the publisher.

Added to Escape Meridian: 2026-11-10T20:04:00.978Z. First observed: 2026-10-30T07:45:43.280Z. Retrieved: 2026-10-31T08:02:27.885Z.

Referenced by

Recorded citations and public file attachments. A reference alone does not establish agreement or influence.

No public references recorded here yet.

Reference data (JSON)

Limits

’s notice does not state how many people installed the affected versions or how many hosts were compromised. Cursor says it has no evidence that other versions of the extension or the official distribution were affected; that statement is limited to the evidence described in the notice. The notice says the attacker server no longer functions, but does not quantify any resulting reduction in risk or describe the number of successful attacks.

Open question

How many people installed the affected versions, and how many hosts were compromised? ’s notice does not say.

Source-stated

Cursor identifies Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS as malicious versions available in its VS Code Extension Marketplace on October 29, 2026, and says they were not developed by Anthropic.

Today we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace: Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS. These malicious versions of the extension were not developed by Anthropic.

Source-stated

Cursor says the modified extension collected host and user information and attempted to install a persistent SSH backdoor, including by adding an attacker-controlled SSH key and opening a reverse SSH tunnel.

Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.

Source-stated

Cursor says the tunnel step would fail on most macOS and Windows hosts without administrator privileges, but the extension still added the SSH key, installed persistence, and sent host details.

On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker.

Source-stated

Cursor says it removed the malicious versions, audited the marketplace, rotated its keys, rebuilt the marketplace, and took the malicious server offline.

We rotated our keys, rebuilt the marketplace, and brought it back online. We worked with the hosting provider to take the malicious server offline, disrupting the attack by blocking the connection to that server.

Source-stated

Cursor advises affected users that uninstalling the extension may not remove the standalone persistence scripts, and recommends investigation and remediation steps.

Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.

Source and contributor context

Cursor · Publisher

The publisher is identified here. No individual author has been inferred.

Source media

No suitable media was found by the supported page extraction.

Terms and references

Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.

Cursor

Cursor makes an AI coding environment and publishes evaluations of agents working on software tasks.

Claude

Claude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding.

Marketplace

Marketplace is a public radio business news outlet publishing reporting on the economy, companies, technology and work.

Anthropic

Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems.

Editorial provenance

Version 1. Publication ID: bc549f5f-2a5f-4949-8b15-fad62420f176.

Prepared by server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna); grounding review by gpt-6-luna.

Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T20:04:00.978Z. This checks fidelity to the source, not whether its claims are independently true.

Editorial selection: accept; reasons: material_development.

Observation: 56bb18b490fb615810d3519836f345bafcf504e8c91df17aaece2b33062072ae. Source text hash: 0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3.

Revision and source-check history

Version 1 · 2026-11-10T20:04:00.978Z

Cursor reports malicious Claude Code extension versions in its marketplace

says malicious versions of ’s Code extension, 2.1.312 and 2.1.313, were available in the Cursor VS Code Extension for Windows and macOS on October 29, 2026. Cursor says the versions were not developed by Anthropic and were available between 2:27am PT and 1:35pm PT. According to Cursor, the modified extension collected host and user details and tried to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel. Cursor says errors in the malicious code meant the tunnel step would fail on most hosts without administrator privileges, but the extension still added the key, installed persistence, and sent host details. The attacker server is now offline, according to the notice. Cursor says it removed the versions, shut down and audited the marketplace, rotated its keys, rebuilt the marketplace, and brought it back online. It advises people who installed either version during the affected period to check for indicators, investigate affected hosts, remove persistence, and rotate credentials accessible from those hosts. Uninstalling the extension may not be enough because standalone persistence scripts can keep running. How many people installed the affected versions, and how many hosts were compromised? Cursor’s notice does not say.

Original source

· Article

Source details

Original source date: Oct 29, 2026 (2026-10-29T12:00:00.000Z).

Date basis: Date stated by the publisher.

Added to Escape Meridian: 2026-11-10T20:04:00.978Z. First observed: 2026-10-30T07:45:43.280Z. Retrieved: 2026-10-31T08:02:27.885Z.

Limits

’s notice does not state how many people installed the affected versions or how many hosts were compromised. Cursor says it has no evidence that other versions of the extension or the official distribution were affected; that statement is limited to the evidence described in the notice. The notice says the attacker server no longer functions, but does not quantify any resulting reduction in risk or describe the number of successful attacks.

Open question

How many people installed the affected versions, and how many hosts were compromised? ’s notice does not say.

Source-stated

Cursor identifies Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS as malicious versions available in its VS Code Extension Marketplace on October 29, 2026, and says they were not developed by Anthropic.

Today we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace: Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS. These malicious versions of the extension were not developed by Anthropic.

Source-stated

Cursor says the modified extension collected host and user information and attempted to install a persistent SSH backdoor, including by adding an attacker-controlled SSH key and opening a reverse SSH tunnel.

Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.

Source-stated

Cursor says the tunnel step would fail on most macOS and Windows hosts without administrator privileges, but the extension still added the SSH key, installed persistence, and sent host details.

On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker.

Source-stated

Cursor says it removed the malicious versions, audited the marketplace, rotated its keys, rebuilt the marketplace, and took the malicious server offline.

We rotated our keys, rebuilt the marketplace, and brought it back online. We worked with the hosting provider to take the malicious server offline, disrupting the attack by blocking the connection to that server.

Source-stated

Cursor advises affected users that uninstalling the extension may not remove the standalone persistence scripts, and recommends investigation and remediation steps.

Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.

Source and contributor context

Cursor · Publisher

The publisher is identified here. No individual author has been inferred.

Source media

No suitable media was found by the supported page extraction.

Terms and references

Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.

Cursor

Cursor makes an AI coding environment and publishes evaluations of agents working on software tasks.

Claude

Claude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding.

Marketplace

Marketplace is a public radio business news outlet publishing reporting on the economy, companies, technology and work.

Anthropic

Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems.

Editorial provenance

Version 1. Publication ID: bc549f5f-2a5f-4949-8b15-fad62420f176.

Prepared by server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna); grounding review by gpt-6-luna.

Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-10T20:04:00.978Z. This checks fidelity to the source, not whether its claims are independently true.

Editorial selection: accept; reasons: material_development.

Observation: 56bb18b490fb615810d3519836f345bafcf504e8c91df17aaece2b33062072ae. Source text hash: 0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3.

uncertain · 2026-11-10T20:04:00.978Z · anthropic/claude-opus-5.5

Publication: bc549f5f-2a5f-4949-8b15-fad62420f176

attribution — pass: The reading consistently attributes the incident account, technical findings, response steps and advice to Cursor, and keeps Anthropic's non-involvement as Cursor's statement. The source and publisher are correctly identified.

These malicious versions of the extension were not developed by Anthropic.

summary — uncertain: The reading is accurate, but readers without a security background may not see the central stake. The summary drops the source's plain framing that the code tried to install a 'persistent SSH backdoor', meaning remote access for the attacker. It also uses 'installed persistence' and 'reverse SSH tunnel' without context. Cursor is not identified as a code editor, and Claude Code is not identified as Anthropic's AI coding tool. Smallest repair: restore the 'persistent SSH backdoor' phrase in the second paragraph and use term-library tooltips for SSH key, reverse SSH tunnel and persistence.

The extension runs malicious code that attempts to install a persistent SSH backdoor.

date — uncertain: October 29, 2026 matches the notice's 'today' and its remediation window. However, originalPublished is an instant of 12:00 UTC, which is about 5am PT. The notice describes the malicious version as available until 1:35pm PT that same day, so the stated instant falls before events the notice reports. The calendar date seems right, but the precise instant looks like a placeholder. The Oct 30 update is a later revision, not the first publication.

Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available

support — pass: Each claim and limitation is grounded in the notice. These include the versions and platforms, the data collected, the failed tunnel step without admin rights, the key added and persistence installed, Cursor's response steps, and the warning that uninstalling may not suffice. The question about install counts and compromised hosts follows from the notice's silence and is not leading. No benefits or impacts are invented.

The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker. Follow the remediation steps below regardless.

media — pass: The selected media is the verified direct link to Cursor's original security notice, which is the most direct way to access the source. No other source media was found.

Challenge or correct this reading

Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.