# Cursor Says a Tampered Claude Code Extension on Its Marketplace Reached Up to 5,000 Users

Times of AI Desk · 2026-10-30 · Security

[https://timesof.ai/2026/10/cursor-marketplace-tampered-claude-code-extension-5000-users](https://timesof.ai/2026/10/cursor-marketplace-tampered-claude-code-extension-5000-users)

> Cursor says a maliciously modified version of Anthropic's Claude Code extension, version 2.1.313, was available on its VS Code extension marketplace for about 11 hours on October 29 and tried to install a persistent SSH backdoor. The package was not built by Anthropic. Cursor says at most 5,000 users were affected, it shut down and rebuilt the marketplace, and the attacker's server is offline.

The incident shows the attack surface that comes with installing AI coding agents as editor extensions: a counterfeit build of a trusted agent can reach thousands of developer machines within hours. Cursor, which Reuters describes as [owned by SpaceX](https://timesof.ai/2026/08/openai-cursor-spacex-acquisition-cutoff), said a maliciously modified version of Anthropic's Claude Code extension was available on its VS Code extension marketplace on **October 29**, affecting up to **5,000 users**.

## What Cursor says happened

In a security notice, Cursor says version **2.1.313** of the Anthropic.claude-code package was live on its marketplace between about 2:27 a.m. and 1:35 p.m. Pacific time on October 29, and that it "was not developed by Anthropic." Cursor says the code collected host and user details such as hostname, username, operating system and public IP address, and tried to set up remote SSH access for the attacker.

Cursor says one key step would fail on most macOS and Windows machines because it requires administrator rights, so the attacker could not have logged in through the tunnel on those hosts. It says the extension still added the attacker's key, installed persistence and sent host details, and it published checks and remediation scripts for affected users. Cursor says it worked with the hosting provider to take the attacker's server offline.

## What Cursor did

Cursor says it removed the version on detection, shut down the whole marketplace as a precaution, rotated its keys, rebuilt the marketplace and brought it back online. It says it audited access and found no other extensions had been tampered with, and that it has no evidence other versions or the official distribution were affected. Reuters reported the disclosure on October 30 and said Anthropic did not immediately respond to a request for comment.

## Limits

- The timeline, the 5,000-user ceiling and the technical findings are Cursor's own; Cursor has not said how the tampered package got onto its marketplace.
- Reuters' report repeats Cursor's account; we found no independent forensic analysis of the package.
- We have no comment from Anthropic.

## Sources

- [Cursor: Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace (October 29, 2026)](https://cursor.com/blog/claude-code-extension-security-notice)
- [Reuters via StreetInsider: Cursor says up to 5,000 users affected by tampered Claude Code extension (October 30, 2026)](https://www.streetinsider.com/Reuters/Cursor+says+up+to+5%2C000+users+affected+by+tampered+Claude+Code+extension/27260087.html)