Cursor Removes Malicious Versions of Anthropic Claude Code Extension

On October 29, 2026, Cursor identified a security incident involving tampered versions of the Anthropic.claude-code extension (versions 2.1.312 and 2.1.313 for Windows and macOS) distributed via the Cursor VS Code Extension Marketplace. According to Cursor, these unauthorized versions were not built by Anthropic and were available for download between approximately 2:27am PT and 1:35pm PT before being removed. The malicious package collected host details—including usernames, environment variable names, Git email, and public IP addresses—and attempted to establish a persistent reverse SSH tunnel. Cursor noted that turning on the local SSH service generally requires administrator privileges, meaning the connection failed on most standard user configurations. In response, Cursor took the marketplace temporarily offline, rotated keys, audited other extensions, and collaborated with the hosting provider to shut down the external attacker server.

Key takeaways

• Malicious versions 2.1.312 and 2.1.313 of Anthropic.claude-code were uploaded by unauthorized parties to the Cursor extension marketplace.
• The code collected system telemetry and attempted to establish persistent reverse SSH backdoors on Windows and macOS.
• Most standard installations blocked SSH service activation due to a lack of administrative permissions.
• Cursor shut down the marketplace temporarily, rotated security keys, and worked with cloud providers to disable the attacker server.