Cursor says fake Claude Code extension may have affected up to 5,000 users

What is changing?

Cursor said on October 30 that it had removed a maliciously modified Claude Code extension from its marketplace. According to information the company provided to Reuters, the build was available on October 29 from about 2:27 a.m. to 1:35 p.m. PT and may have reached up to 5,000 users. Cursor says the extension was not developed by Anthropic; after detection, it blocked distribution, shut down and rebuilt the marketplace as a precaution, and found no impact on other extensions.

Phorion’s technical analysis shows that injected code in the Open VSX 2.1.313 package collected host information, attempted to plant an SSH authorization key and tried to establish persistent access through a reverse tunnel. The code included persistence steps for macOS, Linux and Windows, although Cursor says a key part of the remote-access chain would have failed on most machines because it required administrator privileges.

There is no verified evidence that the incident affected Anthropic’s official VS Code Marketplace distribution or core infrastructure. Teams should search for Open VSX version 2.1.313, inspect SSH keys, startup entries and unusual outbound connections, and rotate credentials accessible from affected machines using a clean system.