Malicious Claude Code extension in Cursor’s marketplace attempted remote access and data theft

What happened

A tampered Claude Code extension was available in Cursor’s extension marketplace for about eleven hours on Thursday, affecting up to 5,000 users, according to Cursor. Anthropic had no involvement in developing it; the extension attempted to collect machine and user information and establish remote access, which Cursor says likely required unavailable admin privileges on most machines. Cursor removed the extension, temporarily shut down the marketplace, and restored it after working with providers to neutralize the malware and confirming no further risk; no other extensions were affected.

Read next

• More changes in today’s briefingConfigure the ChatGPT desktop app with Amazon Bedrock in AWS GovCloud (US)

Reported by 3 sources

The story so far

Cursor removed a backdoored Claude Code VS Code extension from its IDE marketplace after an incident affecting at most 5,000 users, the company said. The Decoder reported that Cursor temporarily shut down the marketplace and restored it after working with providers to neutralize the malware and confirming there was no further risk. The extension was available for about eleven hours and attempted to collect machine and user information and establish remote access, The Decoder reported. Cursor said the remote-access attempt likely required administrator privileges unavailable on most machines and that no other extensions were affected. Researchers cited by Ars Technica said malicious version 2.1.313 was distributed through Anthropic’s official account. Cursor said Anthropic did not develop the malicious version; that statement concerns who created it, while the researchers’ finding concerns the account used to distribute it. Independent researcher Kevin Beaumont said Anthropic pushed version 2.1.314 several hours later.