Cursor's extension marketplace served malicious Claude Code extension versions 2.1.312 and 2.1.313 for Windows and macOS on October 29

Cursor published a security notice on October 29, 2026, and updated it on October 30 at 11:30 AM PT, saying it updated the indicators and clarified the affected versions. The notice says maliciously modified versions of Anthropic's Claude Code extension, Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS, were available in the Cursor VS Code Extension Marketplace between about 2:27 AM and 1:35 PM PT on October 29. Cursor says these versions were not developed by Anthropic, and that it has no evidence that other versions of the extension or the official distribution are affected. An archived copy of the notice from October 30 at 1:43 AM PDT named only 2.1.313 and said at most 5,000 users were affected. The updated notice does not give a number of affected users.

According to the notice, the extension collected host and user details, including the hostname, username, environment variable names, working directories and configured Git email, and sent them to an attacker server. It attempted to add an attacker-controlled SSH key to the user's authorized_keys file, enable the local SSH service and open a reverse SSH tunnel. Cursor says errors in the malicious code would make this step fail except in highly unusual circumstances where Cursor was started with administrator privileges. The notice also says the extension added the attacker's SSH key and installed persistence: a LaunchAgent on macOS, and on Windows a scheduled task with a Startup script fallback. Cursor says turning on SSH needs admin rights the extension does not have on most macOS and Windows machines, so on those machines the attacker could not have logged in through the tunnel. Cursor worked with the hosting provider to take the attacker server offline.

Cursor removed the malicious version, shut down its extension marketplace as a precaution, checked that no other extensions were tampered with, rotated its keys and rebuilt the marketplace. Its notice gives a check and a remediation script for macOS and for Windows, and says uninstalling the extension may not be enough, because the payload drops standalone persistence scripts that keep running. Cursor also advises rotating credentials and sessions reachable from an affected machine, from a trusted system, because the limited env-var collection "does not rule out later credential access over the backdoor."