Fake Claude Code extension on Cursor's extension marketplace exposed up to 5,000 users to data theft and remote access
Cursor said a modified, malicious version of Anthropic's Claude Code VS Code extension (Anthropic.claude-code version 2.1.313), not developed by Anthropic, was available on its Cursor IDE extension marketplace on October 29, impacting at most 5,000 users. Once installed, it tried to collect system details such as computer name, username, Git email and public IP, add an unauthorised SSH key and create a hidden remote connection, with background programs that persisted after uninstall. Cursor took down the marketplace, removed the package, shut down the attack server and reinstated the marketplace. It told users to update to version 2.1.314, run its remediation scripts and change credentials.
What the AI did
No AI system acted on its own. Attackers disguised malware as Anthropic's Claude Code AI coding extension (version 2.1.313) and placed it on the extension marketplace of Cursor, an AI-powered code editor. Developers who installed it got a program that collected details about their computers and tried to open a hidden remote connection for the attackers.
First reported October 30, 2026 · Added to the register November 7, 2026 · 1 source
- Users impacted (maximum)
- at most 5,000
- Model
- Claude Code (Anthropic.claude-code 2.1.313)
- Affected
- Cursor IDE users
- When it happened
- October 29, 2026
- First reported
- October 30, 2026
What this means for you
Could this affect you?
If your developers use the Cursor code editor. Developers who installed or updated the Claude Code extension to version 2.1.313 through Cursor's extension marketplace on October 29 were exposed to data collection and a possible hidden remote connection. Cursor said at most 5,000 users were affected, and it warned that simply uninstalling the extension may not be enough.
What to check
- Check developer machines for an unauthorised SSH key (a remote-login key) labelled svc-telemetry.
- Run Cursor's official remediation scripts rather than just uninstalling the extension.
- Change passwords and access keys from a clean device, and update to Claude Code for VS Code version 2.1.314.
- Review controls on which code-editor add-ons and marketplaces staff may use.
Areas of your AI programme this touches
Timeline
- October 29, 2026Happened
- October 30, 2026First reported
Every fact and its source (5)
- Window malicious extension was available2026-10-29, 2:27 am to 1:35 pm PT“was available between 2:27 am and 1:35 pm Pacific Time on October 29”[1]
- Indicator of compromiseUnauthorised SSH key labelled svc-telemetry“checking your device for an unauthorised SSH key labelled svc-telemetry”[1]
- Fixed versionClaude Code for VS Code 2.1.314“We are asking all customers update to Claude Code for VS Code version 2.1.314”[1]
- Origin of malicious extensionNot developed by Anthropic“This malicious version of the extension was not developed by Anthropic.”[1]
- Cursor responseRemoved package and shut down attack server“Cursor also confirmed that they have removed the package, shut down the server used in the attack”[1]
Sources
How this record is classified. Severity S (4/5): real harm to one organisation, data exposed, or a containment failure. OECD level: incident, an event in which an AI system led to actual harm. Evidence: Confirmed, meaning a company, official or court statement.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
