Tampered Claude Code extension on Cursor marketplace exposed up to 5,000 developers
This story is from 2026-10-30. It is preserved in the archive; the latest stories are on the live feed.
A malicious version of Anthropic's Claude Code VS Code extension was distributed via Cursor's marketplace for about 11 hours on October 29, installing a persistent SSH backdoor and attempting data theft on up to 5,000 users. Cursor pulled the marketplace; how the verified account was accessed remains unknown.
Read the full story at The Register AI/ML ↗
Timeline · 12 reports
- 2026-10-30 21:58 · Reuters AI
Cursor says up to 5,000 users affected by tampered Claude Code extension - 2026-10-30 21:09 · Ars Technica AI
Anthropic VS code extension on Cursor backdoored for nearly 12 hours - 2026-10-30 18:16 · The Decoder
Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft - 2026-10-30 17:29 · Fast Company AI
Hackers hijacked a Claude Code extension, exposing yet another new AI security risk - 2026-10-30 16:27 · The Register AI/ML
Anthropic: That Claude Code extension compromise… couldn't be us - 2026-10-30 14:36 · BleepingComputer
Malicious Claude Code extension on Cursor planted SSH backdoors - 2026-10-30 12:59 · r/ClaudeAI
A backdoored Claude Code extension hit up to 5,000 Cursor users - 2026-10-30 11:18 · r/LocalLLaMA
Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor - 2026-10-30 08:55 · The Hacker News (security)
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor - 2026-10-30 08:05 · Unite.AI
Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension - 2026-10-30 07:46 · AlphaSignal
Cursor's Claude Code Extension Was Hijacked, Exposing 5,000 Developers to SSH Backdoor - 2026-10-30 07:09 · Hacker News Front Page
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace