Cursor discloses malicious Claude Code extension in its VS Code marketplace

Cursor published a security notice about a maliciously modified Anthropic.claude-code version 2.1.313 in the Cursor VS Code Extension Marketplace. Cursor says the package was not developed by Anthropic and was available from about 2:27 a.m. to 1:35 p.m. Pacific Time on October 29. The company said at most 5,000 users may have been affected and that it would contact them directly. (https://cursor.com/en-US/blog/claude-code-extension-security-notice; https://x.com/cursor_ai/status/2116074289053175808)

Cursor's notice describes the incident as involving unauthorized host information collection and attempted unauthorized access and persistence. Cursor says it removed the package, blocked further distribution, audited the marketplace, and found no evidence that other extensions or official Claude Code distributions were affected. It also says the malicious server was taken offline. (https://cursor.com/en-US/blog/claude-code-extension-security-notice)

What potentially affected users should do

If you installed or updated to version 2.1.313 from Cursor's VS Code extension marketplace during the exposure window, read Cursor's official notice and follow its platform-specific check and remediation instructions. Cursor warns that uninstalling the extension alone may not be sufficient; its notice also advises credential and session rotation from a trusted system when the device may have been affected. (https://cursor.com/en-US/blog/claude-code-extension-security-notice)

This summary intentionally omits technical indicators, commands, file locations, keys, and remediation scripts. Use Cursor's official notice for current instructions, and do not rely on third-party copies of remediation steps.

Sources

• Cursor, security notice on malicious Anthropic.claude-code version 2.1.313: https://cursor.com/en-US/blog/claude-code-extension-security-notice
• Cursor on X, incident announcement (October 30, 2026): https://x.com/cursor_ai/status/2116074289053175808