Malicious Claude Code extension on Cursor marketplace exposed up to 5,000 developers
A tampered copy of Anthropic's Claude Code extension was published on Cursor's marketplace on October 29 and stayed live for about 11 hours, exposing up to 5,000 developers to an SSH backdoor and data theft attempt. Anthropic says it did not build or publish the extension and is working with Cursor on the incident.
Read the full story at Microsoft Research Blog ↗
Timeline · 14 reports
- 2026-10-31 05:00 · Techmeme
Anthropic says a malicious actor used access to Cursor's marketplace to publish a "tampered" copy of the Claude Code extension, which it didn't build or publish - 2026-10-31 01:02 · Microsoft Research Blog
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor - 2026-10-30 21:58 · Reuters AI
Cursor says up to 5,000 users affected by tampered Claude Code extension - 2026-10-30 21:09 · Ars Technica AI
Anthropic VS code extension on Cursor backdoored for nearly 12 hours - 2026-10-30 18:16 · The Decoder
Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft - 2026-10-30 17:29 · Fast Company AI
Hackers hijacked a Claude Code extension, exposing yet another new AI security risk - 2026-10-30 16:27 · The Register AI/ML
Anthropic: That Claude Code extension compromise… couldn't be us - 2026-10-30 14:36 · BleepingComputer
Malicious Claude Code extension on Cursor planted SSH backdoors - 2026-10-30 12:59 · r/ClaudeAI
A backdoored Claude Code extension hit up to 5,000 Cursor users - 2026-10-30 11:18 · r/LocalLLaMA
Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor - 2026-10-30 08:55 · The Hacker News (security)
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor - 2026-10-30 08:05 · Unite.AI
Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension - 2026-10-30 07:46 · AlphaSignal
Cursor's Claude Code Extension Was Hijacked, Exposing 5,000 Developers to SSH Backdoor - 2026-10-30 07:09 · Hacker News Front Page
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace