{"id":"479eb803c7112ef1884b672840a91bf793590064d211e36ec2db44db4a25c7bc","title":"Cursor reports malicious Claude Code extension versions in its marketplace","argument":"Cursor says malicious versions of Anthropic’s Claude Code extension, 2.1.312 and 2.1.313, were available in the Cursor VS Code Extension Marketplace for Windows and macOS on October 29, 2026. Cursor says the versions were not developed by Anthropic and were available between 2:27am PT and 1:35pm PT.\n\nAccording to Cursor, the modified extension collected host and user details and tried to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel. Cursor says errors in the malicious code meant the tunnel step would fail on most hosts without administrator privileges, but the extension still added the key, installed persistence, and sent host details. The attacker server is now offline, according to the notice.\n\nCursor says it removed the versions, shut down and audited the marketplace, rotated its keys, rebuilt the marketplace, and brought it back online. It advises people who installed either version during the affected period to check for indicators, investigate affected hosts, remove persistence, and rotate credentials accessible from those hosts. Uninstalling the extension may not be enough because standalone persistence scripts can keep running.\n\nHow many people installed the affected versions, and how many hosts were compromised? Cursor’s notice does not say.","topicIds":["intelligence-and-discovery","work-and-agency"],"domain":"work","claimType":"attributed reading","limits":"Cursor’s notice does not state how many people installed the affected versions or how many hosts were compromised. Cursor says it has no evidence that other versions of the extension or the official distribution were affected; that statement is limited to the evidence described in the notice. The notice says the attacker server no longer functions, but does not quantify any resulting reduction in risk or describe the number of successful attacks.","speaker":{"name":"Cursor","roleAtSource":"Publisher"},"source":{"title":"Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · Cursor","publisher":"Cursor","format":"Article","url":"https://cursor.com/blog/claude-code-extension-security-notice","publishedAt":"2026-10-29T12:00:00.000Z","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"Cursor identifies Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS as malicious versions available in its VS Code Extension Marketplace on October 29, 2026, and says they were not developed by Anthropic.","excerpt":"Today we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace: Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS. These malicious versions of the extension were not developed by Anthropic.","url":"https://cursor.com/blog/claude-code-extension-security-notice","relationship":"Source-stated"},{"text":"Cursor says the modified extension collected host and user information and attempted to install a persistent SSH backdoor, including by adding an attacker-controlled SSH key and opening a reverse SSH tunnel.","excerpt":"Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.","url":"https://cursor.com/blog/claude-code-extension-security-notice","relationship":"Source-stated"},{"text":"Cursor says the tunnel step would fail on most macOS and Windows hosts without administrator privileges, but the extension still added the SSH key, installed persistence, and sent host details.","excerpt":"On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker.","url":"https://cursor.com/blog/claude-code-extension-security-notice","relationship":"Source-stated"},{"text":"Cursor says it removed the malicious versions, audited the marketplace, rotated its keys, rebuilt the marketplace, and took the malicious server offline.","excerpt":"We rotated our keys, rebuilt the marketplace, and brought it back online.\nWe worked with the hosting provider to take the malicious server offline, disrupting the attack by blocking the connection to that server.","url":"https://cursor.com/blog/claude-code-extension-security-notice","relationship":"Source-stated"},{"text":"Cursor advises affected users that uninstalling the extension may not remove the standalone persistence scripts, and recommends investigation and remediation steps.","excerpt":"Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.","url":"https://cursor.com/blog/claude-code-extension-security-notice","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","checkedAt":"2026-11-10T20:36:09.368Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How many people installed the affected versions, and how many hosts were compromised? Cursor’s notice does not say."},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Cursor reports malicious Claude Code extension versions in its marketplace","summary":"Cursor says malicious versions of Anthropic’s Claude Code extension, 2.1.312 and 2.1.313, were available in the Cursor VS Code Extension Marketplace for Windows and macOS on October 29, 2026. Cursor says the versions were not developed by Anthropic and were available between 2:27am PT and 1:35pm PT.\n\nAccording to Cursor, the modified extension collected host and user details and tried to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel. Cursor says errors in the malicious code meant the tunnel step would fail on most hosts without administrator privileges, but the extension still added the key, installed persistence, and sent host details. The attacker server is now offline, according to the notice.\n\nCursor says it removed the versions, shut down and audited the marketplace, rotated its keys, rebuilt the marketplace, and brought it back online. It advises people who installed either version during the affected period to check for indicators, investigate affected hosts, remove persistence, and rotate credentials accessible from those hosts. Uninstalling the extension may not be enough because standalone persistence scripts can keep running.\n\nHow many people installed the affected versions, and how many hosts were compromised? Cursor’s notice does not say.","question":"How many people installed the affected versions, and how many hosts were compromised? Cursor’s notice does not say.","claims":[{"text":"Cursor identifies Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS as malicious versions available in its VS Code Extension Marketplace on October 29, 2026, and says they were not developed by Anthropic.","excerpt":"Today we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace: Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS. These malicious versions of the extension were not developed by Anthropic.","support":"source-stated"},{"text":"Cursor says the modified extension collected host and user information and attempted to install a persistent SSH backdoor, including by adding an attacker-controlled SSH key and opening a reverse SSH tunnel.","excerpt":"Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.","support":"source-stated"},{"text":"Cursor says the tunnel step would fail on most macOS and Windows hosts without administrator privileges, but the extension still added the SSH key, installed persistence, and sent host details.","excerpt":"On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker.","support":"source-stated"},{"text":"Cursor says it removed the malicious versions, audited the marketplace, rotated its keys, rebuilt the marketplace, and took the malicious server offline.","excerpt":"We rotated our keys, rebuilt the marketplace, and brought it back online.\nWe worked with the hosting provider to take the malicious server offline, disrupting the attack by blocking the connection to that server.","support":"source-stated"},{"text":"Cursor advises affected users that uninstalling the extension may not remove the standalone persistence scripts, and recommends investigation and remediation steps.","excerpt":"Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.","support":"source-stated"}],"limitations":["Cursor’s notice does not state how many people installed the affected versions or how many hosts were compromised.","Cursor says it has no evidence that other versions of the extension or the official distribution were affected; that statement is limited to the evidence described in the notice.","The notice says the attacker server no longer functions, but does not quantify any resulting reduction in risk or describe the number of successful attacks."],"mediaId":"b11cb5d74cc4c0585bf6dc465a690934049b00d5b73625cb7a9f0b9e1b47b836","correctionReason":null,"id":"479eb803c7112ef1884b672840a91bf793590064d211e36ec2db44db4a25c7bc","publicationId":"bc549f5f-2a5f-4949-8b15-fad62420f176","version":1,"sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","sourceTitle":"Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · Cursor","publisher":"Cursor","publishedAt":"2026-10-29T12:00:00.000Z","originalPublished":{"value":"2026-10-29T12:00:00.000Z","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-10-30T07:45:43.280Z","createdAt":"2026-11-10T20:04:00.978Z","historical":true,"entityIds":["cursor"],"topicIds":["intelligence-and-discovery","work-and-agency"],"media":[{"id":"b11cb5d74cc4c0585bf6dc465a690934049b00d5b73625cb7a9f0b9e1b47b836","kind":"article","url":"https://cursor.com/blog/claude-code-extension-security-notice","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-31T08:02:28.897Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","checkedAt":"2026-11-10T20:36:09.368Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"b11cb5d74cc4c0585bf6dc465a690934049b00d5b73625cb7a9f0b9e1b47b836","confidence":0.9,"provider":"typesafe","model":"jev-1.13.0","inputHash":"88dddeb0dd2f9ed9e4845c26ac5d936d3713293eb3998afc40dc5afdffcbd694","decidedAt":"2026-10-31T08:02:31.912Z"},"provenance":{"textHash":"0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3","observationId":"56bb18b490fb615810d3519836f345bafcf504e8c91df17aaece2b33062072ae","retrievedAt":"2026-10-31T08:02:27.885Z","kind":"publisher-page","preparer":{"model":"server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna)","runId":"9230e574-a42c-4c91-8452-c306328fe2ef"},"reviewer":{"model":"gpt-6-luna","runId":"e23dba79-67bf-4fb5-8d9b-a11c3cd76cfe"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-10T20:04:00.978Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[],"authorRole":"article-author","hosts":[],"status":"conflicting","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Cursor","url":"https://cursor.com/","kind":"Organization","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Cursor","status":"conflicting","provenance":{"basis":"article-jsonld","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","locator":"document/html[1]/body[1]/main[23]/script[0]@22630.author"},"assertionId":"821dfd45a116d183b53a2b894c9c7bd73e8a2b0362c47c0aba032812b82c4eaa:participation:0","identity":{"version":"entity-identity-v1","status":"conflicting","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T20:36:09.368Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"821dfd45a116d183b53a2b894c9c7bd73e8a2b0362c47c0aba032812b82c4eaa","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","contentSha256":"69dae35407de881a9c3cf8e92bf750596d64082bb59c6bc66f4f5ed400238425","textHash":"0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3","observedAt":"2026-11-10T20:36:09.368Z"}},{"actor":{"name":"Cursor Team","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Cursor Team","status":"conflicting","provenance":{"basis":"head-meta","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","locator":"head/meta[name=author|citation_author]"},"assertionId":"821dfd45a116d183b53a2b894c9c7bd73e8a2b0362c47c0aba032812b82c4eaa:participation:1","identity":{"version":"entity-identity-v1","status":"conflicting","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T20:36:09.368Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"821dfd45a116d183b53a2b894c9c7bd73e8a2b0362c47c0aba032812b82c4eaa","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","contentSha256":"69dae35407de881a9c3cf8e92bf750596d64082bb59c6bc66f4f5ed400238425","textHash":"0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3","observedAt":"2026-11-10T20:36:09.368Z"}}],"participationCoverage":{"total":2,"returned":2,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","snapshotId":"821dfd45a116d183b53a2b894c9c7bd73e8a2b0362c47c0aba032812b82c4eaa","contentSha256":"69dae35407de881a9c3cf8e92bf750596d64082bb59c6bc66f4f5ed400238425","textHash":"0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3","observedAt":"2026-11-10T20:36:09.368Z","basis":"publisher-page-metadata","sourceLinks":17,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/479eb803c7112ef1884b672840a91bf793590064d211e36ec2db44db4a25c7bc/source"}},"canonicalUrl":"https://escapemeridian.com/readings/cursor-reports-malicious-claude-code-extension-versions-in-its-479eb803","formats":{"html":"/readings/cursor-reports-malicious-claude-code-extension-versions-in-its-479eb803","markdown":"/readings/cursor-reports-malicious-claude-code-extension-versions-in-its-479eb803.md","json":"/readings/cursor-reports-malicious-claude-code-extension-versions-in-its-479eb803.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[],"entities":[{"id":"cursor","name":"Cursor","kind":"organization","context":"Cursor makes an AI coding environment and publishes evaluations of agents working on software tasks.","referenceUrls":["https://cursor.com/","https://cursor.com/evals","https://cursor.com/blog/real-time-rl-for-composer"],"path":"/entities/cursor","json":"/entities/cursor.json","markdown":"/entities/cursor.md"},{"id":"claude","name":"Claude","kind":"model","context":"Claude is Anthropic’s family of AI models and assistants for tasks such as writing, analysis and coding.","referenceUrls":["https://claude.com/product/overview","https://www.anthropic.com/news","https://www.anthropic.com/research/team/economics"],"path":"/entities/claude","json":"/entities/claude.json","markdown":"/entities/claude.md"},{"id":"marketplace","name":"Marketplace","kind":"organization","context":"Marketplace is a public radio business news outlet publishing reporting on the economy, companies, technology and work.","referenceUrls":["https://www.marketplace.org/"],"path":"/entities/marketplace","json":"/entities/marketplace.json","markdown":"/entities/marketplace.md"},{"id":"anthropic","name":"Anthropic","kind":"organization","context":"Anthropic develops Claude and publishes research about AI capability, safety and how people use its systems.","referenceUrls":["https://www.anthropic.com/news","https://www.anthropic.com/research/team/economics"],"path":"/entities/anthropic","json":"/entities/anthropic.json","markdown":"/entities/anthropic.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"479eb803c7112ef1884b672840a91bf793590064d211e36ec2db44db4a25c7bc","revision":"bc549f5f-2a5f-4949-8b15-fad62420f176","revisionKind":"publication-id","title":"Cursor reports malicious Claude Code extension versions in its marketplace","url":"https://escapemeridian.com/readings/cursor-reports-malicious-claude-code-extension-versions-in-its-479eb803"},"source":{"type":"source","id":"https://cursor.com/blog/claude-code-extension-security-notice","revision":"0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3","revisionKind":"sha256-source-text","title":"Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · Cursor","url":"https://cursor.com/blog/claude-code-extension-security-notice"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"479eb803c7112ef1884b672840a91bf793590064d211e36ec2db44db4a25c7bc","title":"Cursor reports malicious Claude Code extension versions in its marketplace","argument":"Cursor says malicious versions of Anthropic’s Claude Code extension, 2.1.312 and 2.1.313, were available in the Cursor VS Code Extension Marketplace for Windows and macOS on October 29, 2026. Cursor says the versions were not developed by Anthropic and were available between 2:27am PT and 1:35pm PT.\n\nAccording to Cursor, the modified extension collected host and user details and tried to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel. Cursor says errors in the malicious code meant the tunnel step would fail on most hosts without administrator privileges, but the extension still added the key, installed persistence, and sent host details. The attacker server is now offline, according to the notice.\n\nCursor says it removed the versions, shut down and audited the marketplace, rotated its keys, rebuilt the marketplace, and brought it back online. It advises people who installed either version during the affected period to check for indicators, investigate affected hosts, remove persistence, and rotate credentials accessible from those hosts. Uninstalling the extension may not be enough because standalone persistence scripts can keep running.\n\nHow many people installed the affected versions, and how many hosts were compromised? Cursor’s notice does not say.","topicIds":["intelligence-and-discovery","work-and-agency"],"domain":"work","claimType":"attributed reading","limits":"Cursor’s notice does not state how many people installed the affected versions or how many hosts were compromised. Cursor says it has no evidence that other versions of the extension or the official distribution were affected; that statement is limited to the evidence described in the notice. The notice says the attacker server no longer functions, but does not quantify any resulting reduction in risk or describe the number of successful attacks.","speaker":{"name":"Cursor","roleAtSource":"Publisher"},"source":{"title":"Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · Cursor","publisher":"Cursor","format":"Article","url":"https://cursor.com/blog/claude-code-extension-security-notice","publishedAt":"2026-10-29T12:00:00.000Z","dateBasis":"Date stated by the publisher."},"evidence":[{"text":"Cursor identifies Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS as malicious versions available in its VS Code Extension Marketplace on October 29, 2026, and says they were not developed by Anthropic.","excerpt":"Today we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace: Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS. These malicious versions of the extension were not developed by Anthropic.","url":"https://cursor.com/blog/claude-code-extension-security-notice","relationship":"Source-stated"},{"text":"Cursor says the modified extension collected host and user information and attempted to install a persistent SSH backdoor, including by adding an attacker-controlled SSH key and opening a reverse SSH tunnel.","excerpt":"Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.","url":"https://cursor.com/blog/claude-code-extension-security-notice","relationship":"Source-stated"},{"text":"Cursor says the tunnel step would fail on most macOS and Windows hosts without administrator privileges, but the extension still added the SSH key, installed persistence, and sent host details.","excerpt":"On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker.","url":"https://cursor.com/blog/claude-code-extension-security-notice","relationship":"Source-stated"},{"text":"Cursor says it removed the malicious versions, audited the marketplace, rotated its keys, rebuilt the marketplace, and took the malicious server offline.","excerpt":"We rotated our keys, rebuilt the marketplace, and brought it back online.\nWe worked with the hosting provider to take the malicious server offline, disrupting the attack by blocking the connection to that server.","url":"https://cursor.com/blog/claude-code-extension-security-notice","relationship":"Source-stated"},{"text":"Cursor advises affected users that uninstalling the extension may not remove the standalone persistence scripts, and recommends investigation and remediation steps.","excerpt":"Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.","url":"https://cursor.com/blog/claude-code-extension-security-notice","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","checkedAt":"2026-11-10T20:36:09.368Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How many people installed the affected versions, and how many hosts were compromised? Cursor’s notice does not say."},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"Cursor reports malicious Claude Code extension versions in its marketplace","summary":"Cursor says malicious versions of Anthropic’s Claude Code extension, 2.1.312 and 2.1.313, were available in the Cursor VS Code Extension Marketplace for Windows and macOS on October 29, 2026. Cursor says the versions were not developed by Anthropic and were available between 2:27am PT and 1:35pm PT.\n\nAccording to Cursor, the modified extension collected host and user details and tried to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel. Cursor says errors in the malicious code meant the tunnel step would fail on most hosts without administrator privileges, but the extension still added the key, installed persistence, and sent host details. The attacker server is now offline, according to the notice.\n\nCursor says it removed the versions, shut down and audited the marketplace, rotated its keys, rebuilt the marketplace, and brought it back online. It advises people who installed either version during the affected period to check for indicators, investigate affected hosts, remove persistence, and rotate credentials accessible from those hosts. Uninstalling the extension may not be enough because standalone persistence scripts can keep running.\n\nHow many people installed the affected versions, and how many hosts were compromised? Cursor’s notice does not say.","question":"How many people installed the affected versions, and how many hosts were compromised? Cursor’s notice does not say.","claims":[{"text":"Cursor identifies Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS as malicious versions available in its VS Code Extension Marketplace on October 29, 2026, and says they were not developed by Anthropic.","excerpt":"Today we identified a security incident involving a specific extension in the Cursor VS Code Extension Marketplace: Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS. These malicious versions of the extension were not developed by Anthropic.","support":"source-stated"},{"text":"Cursor says the modified extension collected host and user information and attempted to install a persistent SSH backdoor, including by adding an attacker-controlled SSH key and opening a reverse SSH tunnel.","excerpt":"Collects and reports host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.","support":"source-stated"},{"text":"Cursor says the tunnel step would fail on most macOS and Windows hosts without administrator privileges, but the extension still added the SSH key, installed persistence, and sent host details.","excerpt":"On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker.","support":"source-stated"},{"text":"Cursor says it removed the malicious versions, audited the marketplace, rotated its keys, rebuilt the marketplace, and took the malicious server offline.","excerpt":"We rotated our keys, rebuilt the marketplace, and brought it back online.\nWe worked with the hosting provider to take the malicious server offline, disrupting the attack by blocking the connection to that server.","support":"source-stated"},{"text":"Cursor advises affected users that uninstalling the extension may not remove the standalone persistence scripts, and recommends investigation and remediation steps.","excerpt":"Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.","support":"source-stated"}],"limitations":["Cursor’s notice does not state how many people installed the affected versions or how many hosts were compromised.","Cursor says it has no evidence that other versions of the extension or the official distribution were affected; that statement is limited to the evidence described in the notice.","The notice says the attacker server no longer functions, but does not quantify any resulting reduction in risk or describe the number of successful attacks."],"mediaId":"b11cb5d74cc4c0585bf6dc465a690934049b00d5b73625cb7a9f0b9e1b47b836","correctionReason":null,"id":"479eb803c7112ef1884b672840a91bf793590064d211e36ec2db44db4a25c7bc","publicationId":"bc549f5f-2a5f-4949-8b15-fad62420f176","version":1,"sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","sourceTitle":"Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · Cursor","publisher":"Cursor","publishedAt":"2026-10-29T12:00:00.000Z","originalPublished":{"value":"2026-10-29T12:00:00.000Z","precision":"instant","basis":"publisher_page"},"firstObservedAt":"2026-10-30T07:45:43.280Z","createdAt":"2026-11-10T20:04:00.978Z","historical":true,"entityIds":["cursor"],"topicIds":["intelligence-and-discovery","work-and-agency"],"media":[{"id":"b11cb5d74cc4c0585bf6dc465a690934049b00d5b73625cb7a9f0b9e1b47b836","kind":"article","url":"https://cursor.com/blog/claude-code-extension-security-notice","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-31T08:02:28.897Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","checkedAt":"2026-11-10T20:36:09.368Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"b11cb5d74cc4c0585bf6dc465a690934049b00d5b73625cb7a9f0b9e1b47b836","confidence":0.9,"provider":"typesafe","model":"jev-1.13.0","inputHash":"88dddeb0dd2f9ed9e4845c26ac5d936d3713293eb3998afc40dc5afdffcbd694","decidedAt":"2026-10-31T08:02:31.912Z"},"provenance":{"textHash":"0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3","observationId":"56bb18b490fb615810d3519836f345bafcf504e8c91df17aaece2b33062072ae","retrievedAt":"2026-10-31T08:02:27.885Z","kind":"publisher-page","preparer":{"model":"server-excerpt-repair/stream-excerpt-repair-v1 (original draft: gpt-6-luna)","runId":"9230e574-a42c-4c91-8452-c306328fe2ef"},"reviewer":{"model":"gpt-6-luna","runId":"e23dba79-67bf-4fb5-8d9b-a11c3cd76cfe"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-10T20:04:00.978Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[],"authorRole":"article-author","hosts":[],"status":"conflicting","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Cursor","url":"https://cursor.com/","kind":"Organization","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Cursor","status":"conflicting","provenance":{"basis":"article-jsonld","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","locator":"document/html[1]/body[1]/main[23]/script[0]@22630.author"},"assertionId":"821dfd45a116d183b53a2b894c9c7bd73e8a2b0362c47c0aba032812b82c4eaa:participation:0","identity":{"version":"entity-identity-v1","status":"conflicting","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T20:36:09.368Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"821dfd45a116d183b53a2b894c9c7bd73e8a2b0362c47c0aba032812b82c4eaa","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","contentSha256":"69dae35407de881a9c3cf8e92bf750596d64082bb59c6bc66f4f5ed400238425","textHash":"0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3","observedAt":"2026-11-10T20:36:09.368Z"}},{"actor":{"name":"Cursor Team","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Cursor Team","status":"conflicting","provenance":{"basis":"head-meta","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","locator":"head/meta[name=author|citation_author]"},"assertionId":"821dfd45a116d183b53a2b894c9c7bd73e8a2b0362c47c0aba032812b82c4eaa:participation:1","identity":{"version":"entity-identity-v1","status":"conflicting","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-10T20:36:09.368Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"821dfd45a116d183b53a2b894c9c7bd73e8a2b0362c47c0aba032812b82c4eaa","sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","contentSha256":"69dae35407de881a9c3cf8e92bf750596d64082bb59c6bc66f4f5ed400238425","textHash":"0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3","observedAt":"2026-11-10T20:36:09.368Z"}}],"participationCoverage":{"total":2,"returned":2,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://cursor.com/blog/claude-code-extension-security-notice","snapshotId":"821dfd45a116d183b53a2b894c9c7bd73e8a2b0362c47c0aba032812b82c4eaa","contentSha256":"69dae35407de881a9c3cf8e92bf750596d64082bb59c6bc66f4f5ed400238425","textHash":"0faac1a0064a0239c00bcd348c6384598302807f42c6f4287242e2e3c1cf08b3","observedAt":"2026-11-10T20:36:09.368Z","basis":"publisher-page-metadata","sourceLinks":17,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/479eb803c7112ef1884b672840a91bf793590064d211e36ec2db44db4a25c7bc/source"}}}],"audits":[{"publicationId":"bc549f5f-2a5f-4949-8b15-fad62420f176","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading consistently attributes the incident account, technical findings, response steps and advice to Cursor, and keeps Anthropic's non-involvement as Cursor's statement. The source and publisher are correctly identified.","excerpt":"These malicious versions of the extension were not developed by Anthropic."},{"dimension":"summary","status":"uncertain","explanation":"The reading is accurate, but readers without a security background may not see the central stake. The summary drops the source's plain framing that the code tried to install a 'persistent SSH backdoor', meaning remote access for the attacker. It also uses 'installed persistence' and 'reverse SSH tunnel' without context. Cursor is not identified as a code editor, and Claude Code is not identified as Anthropic's AI coding tool. Smallest repair: restore the 'persistent SSH backdoor' phrase in the second paragraph and use term-library tooltips for SSH key, reverse SSH tunnel and persistence.","excerpt":"The extension runs malicious code that attempts to install a persistent SSH backdoor."},{"dimension":"date","status":"uncertain","explanation":"October 29, 2026 matches the notice's 'today' and its remediation window. However, originalPublished is an instant of 12:00 UTC, which is about 5am PT. The notice describes the malicious version as available until 1:35pm PT that same day, so the stated instant falls before events the notice reports. The calendar date seems right, but the precise instant looks like a placeholder. The Oct 30 update is a later revision, not the first publication.","excerpt":"Between about 2:27am PT and 1:35pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available"},{"dimension":"support","status":"pass","explanation":"Each claim and limitation is grounded in the notice. These include the versions and platforms, the data collected, the failed tunnel step without admin rights, the key added and persistence installed, Cursor's response steps, and the warning that uninstalling may not suffice. The question about install counts and compromised hosts follows from the notice's silence and is not leading. No benefits or impacts are invented.","excerpt":"The extension added the attacker’s SSH key, installed persistence, and sent host details to the attacker. Follow the remediation steps below regardless."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to Cursor's original security notice, which is the most direct way to access the source. No other source media was found.","excerpt":null}],"createdAt":"2026-11-10T20:04:00.978Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}