Cursor says a tampered copy of Anthropic’s Claude Code extension was available in its VS Code extension marketplace for about 11 hours on October 29, 2026. The affected package was version 2.1.313, and up to 5,000 users may have been exposed. Anthropic did not make or publish the malicious version.
The extension tried to collect details including a computer’s name, username, operating system, home-folder path, Git email and public IP address. It also attempted to add an attacker-controlled key to the computer’s SSH settings and create a persistent remote-access tunnel.
What could the extension do?
Cursor says the tunnel would usually fail on macOS and Windows because enabling the local SSH service requires administrator rights, which the extension typically would not have. The malicious code also had errors. But those limits do not mean every part of the attack failed: Cursor says the extension could still send collected details, add the attacker’s key and install scripts that keep running in the background.
The Register reports that the security firm Phorion first spotted the altered package. Anthropic technical staff member Felix Rieseberg said the incident involved access to Cursor’s marketplace, not a compromise of Anthropic’s systems or employee laptops. Anthropic’s official extension versions were not affected, according to the company.
What should affected users do?
Cursor removed the package, took its marketplace offline while it investigated, checked other extensions and rotated its keys before restoring the marketplace. It also worked with the server’s hosting provider to block the attacker’s connection. Cursor says it found no evidence that other extensions were tampered with.
Anyone who installed or updated to version 2.1.313 from Cursor’s marketplace during the exposure window should follow Cursor’s security instructions. They include checking for an unauthorized SSH key marked “svc-telemetry,” removing any persistence files and tunnel processes, and rotating credentials from a trusted device. Cursor warns that uninstalling the extension alone may not remove the malware’s separate background scripts.
Cursor has not explained how the malicious package entered its marketplace. The company says its findings concern this specific package and that it has no evidence other versions or Anthropic’s official distribution were affected.
Why it matters
Developers who installed this specific extension version through Cursor during the exposure window should check their machines and rotate credentials they used there; simply uninstalling the extension may leave malicious scripts behind. Cursor has not said how the package reached its marketplace, so the route of entry remains unknown.
