Cursor disclosed a malicious build of Anthropic's Claude Code extension on its marketplace
Cursor disclosed that maliciously modified Claude Code extensions, versions 2.1.312 and 2.1.313, were distributed through its marketplace for about 11 hours. Anthropic did not build them. Microsoft Threat Intelligence said injected JavaScript ran when the extension loaded; WIRED reported that up to about 5,000 users may have downloaded them.
More context
On October 29, 2026, Cursor disclosed that a maliciously modified build of Anthropic's Claude Code extension was served from Cursor's VS Code Extension Marketplace for about 11 hours before removal. The tampered versions, 2.1.312 and 2.1.313, were not built by Anthropic. Microsoft and Cursor advisories updated October 30 said the official Visual Studio Marketplace and npm distribution channels were not affected. Cursor's security notice said the payload collected host metadata and attempted to install an attacker-controlled SSH public key labeled svc-telemetry, enabled local SSH services, opened reverse tunnels and persisted through LaunchAgents on macOS or scheduled tasks on Windows. Microsoft Threat Intelligence confirmed injected JavaScript in extension.js ran at module load. WIRED reported that at most about 5,000 users may have downloaded it. Aviatrix Threat Research said direct credential theft was not confirmed.
Was this story useful?
What was the main problem? (optional)
Reporting
Verifier’s note
Aviatrix reports that a trojanized Claude Code extension distributed through Cursor’s marketplace exposed up to 5,000 developers to malware. Plain English describes the same incident and exposure, corroborating the central claim.