Malicious Claude Code extension in Cursor exposed up to 5,000 users

Cursor has disclosed that a maliciously modified version of the Claude Code extension was distributed through its VS Code extension marketplace. The affected package was Anthropic.claude-code version 2.1.313, and Cursor estimates that no more than 5,000 users were exposed. The company stresses that Anthropic did not build the malicious version and that the official distribution and other extension versions are not known to be affected.

The payload collected host and user details, added an attacker-controlled SSH key and tried to enable SSH, create a reverse tunnel and install persistence on macOS or Windows. Cursor says the remote-access step would fail on most machines because it required administrator privileges and contained implementation errors. The attack server has also been taken offline, but the package still installed standalone scripts and sent system information.

Cursor removed the extension, shut down its marketplace as a precaution, audited other packages, rotated keys and rebuilt the service. It says it found no evidence that other extensions were modified.

Anyone who installed or updated the package from Cursor’s marketplace should follow the official security notice rather than simply uninstalling it. Cursor recommends checking for the svc-telemetry SSH key, isolating affected hosts, removing persistence, rotating accessible credentials from a trusted machine and considering a host rebuild. This incident is a supply-chain compromise of Cursor’s marketplace, not a vulnerability in Claude Code itself.