Cursor Removes Backdoored Claude Code Extension That Affected Up to 5,000 Users

1. 05:09
   Ars Technica · AI

   Anthropic’s VS Code Extension on Cursor Was Backdoored for Nearly 12 Hours

   A backdoored version of Anthropic’s official Claude VS Code extension on Cursor affected at most 5,000 users, according to Cursor. Researchers said malicious version 2.1.313 was distributed through Anthropic’s official account, and Kevin Beaumont reported that Anthropic pushed version 2.1.314 several hours later. Neither company has explained how attackers gained account access, and Anthropic had yet to warn customers.

2. 02:16
   The Decoder

   Malicious Claude Code extension in Cursor’s marketplace attempted remote access and data theft

   A tampered Claude Code extension was available in Cursor’s extension marketplace for about eleven hours on Thursday, affecting up to 5,000 users, according to Cursor. Anthropic had no involvement in developing it; the extension attempted to collect machine and user information and establish remote access, which Cursor says likely required unavailable admin privileges on most machines. Cursor removed the extension, temporarily shut down the marketplace, and restored it after working with providers to neutralize the malware and confirming no further risk; no other extensions were affected.

1. 15:46
   Cursor · X

   Cursor reports malicious Claude Code extension impacting at most 5,000 users

   Cursor identified a security incident involving a modified Claude Code VS Code extension accessed through its IDE extension marketplace, impacting at most 5,000 users. The malicious version was not developed by Anthropic. The incident does not impact other extensions.

Trends compare the same continuously observed participants, which may cover fewer sources than current heat. Point or click to inspect hourly heat, or use left and right arrow keys.