Cursor said in a security notice dated 29 October 2026 that a maliciously modified version of Anthropic's Claude Code extension, Anthropic.claude-code version 2.1.313, was available in the Cursor VS Code extension Marketplace between about 2:27am PT and 1:35pm PT that day (about 17:27 on 29 October to 04:35 on 30 October Perth time), and that the version was not developed by Anthropic.

Cursor says at most 5,000 users were affected and that it will contact them directly. According to Cursor, the extension collects host and user information (including hostname, username, OS, environment variable names, configured Git email and public IP), adds an attacker-controlled SSH key labelled svc-telemetry to authorized_keys, tries to enable the local SSH service and open a persistent reverse SSH tunnel via a LaunchAgent on macOS or a scheduled task on Windows, and reports host details to the attacker's server.

Cursor says enabling the SSH service needs admin rights the extension does not have on most macOS and Windows hosts, so on those hosts that step fails and the attacker could not have logged in through the tunnel, but the key, persistence and host-detail report still happen.

Cursor says it removed the version, shut down the marketplace as a precaution, audited access and confirmed no other extensions were tampered with, rotated its keys, rebuilt and restored the marketplace, and worked with the hosting provider to take the attacker's server offline.

It says it has no evidence that other versions of the extension or the official distribution are affected, and it published indicators of compromise and remediation scripts for macOS and Windows. (source: Cursor)