Cursor on X: "We identified a security incident affecting a modified Claude Code VS Code ...

X • October 30, 2026

Cursor @cursor_ai We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace , Grok Bot, Grok or our other SpaceXSI products. In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk. If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: cursor.com/blog/claude-co… 7:46 AM · Oct 30, 2026 · 800.4K Views 424

Alx - ✿ @indie_alx 8h how did a modified build get published under the official anthropic name though? that's the part missing from this post 3

Md Ismail Šojal 🕷️ @0x0SojalSec 8h The only option we can prevent incoming AI-driven cyber attacks and protect our data. 00:00 2

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Trojanized Claude Code Extension Plants SSH Backdoor in Cursor Marketplace On October 29, 2026, a malicious version of the Claude Code extension (version 2.1.313) was available in the Cursor VS Code extension marketplace for approximately 11 hours, affecting up to 5,000 users. This version, not developed by Anthropic, contained a 66-line loader that added an attacker's SSH key, attempted to enable SSH access, and established a reverse SSH tunnel to an external server. The malicious code executed immediately upon loading the extension, collecting user and system information without user interaction. Cursor removed the compromised extension and temporarily took its marketplace offline, later confirming that no other extensions were affected. As of October 30, the attacker's server has been taken offline, but users are advised to follow remediation steps as the backdoor may persist even after uninstalling the extension. 23 sources 60

Cursor on X: "We identified a security incident affecting a modified Claude Code VS Code ...

The full story

Extracted Entities

Attack Types (1)

Domains (1)