---
title: "Cursor Claude Code extension compromise"
description: "A malicious Claude Code extension reached up to 5,000 Cursor users and attempted persistent remote access."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-30"
canonical_url: "https://www.ally.security/incidents/cursor-claude-code-extension-compromise-2026"
markdown_url: "https://www.ally.security/incidents/cursor-claude-code-extension-compromise-2026.md"
stix_url: "https://www.ally.security/incidents/cursor-claude-code-extension-compromise-2026/stix.json"
---

# Cursor Claude Code extension compromise

Cursor removed version 2.1.313 and warned that uninstalling the extension alone does not remove its changes.

Last modified Oct 30, 2026 · 1 source

## Summary

- **Environment:** Cursor extension marketplace and developer machines
- **Operational impact:** Marketplace temporarily closed; potentially affected hosts require remediation
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Cursor](https://cursor.com/) reported a maliciously modified [Claude Code](https://www.anthropic.com/claude-code) extension, version 2.1.313, in its marketplace on October 29. The altered package was not developed by Anthropic. [1](#source-1)

## Impact

Cursor estimated at most 5,000 users were affected. The extension collected host and user metadata, including public IP, configured Git email and environment-variable names. [1](#source-1)

## Timeline

### October 29, 2026 — Malicious package distributed and removed

Cursor’s [security notice](https://cursor.com/blog/claude-code-extension-security-notice) gives an approximate 02:27–13:35 PT distribution window. [1](#source-1)

### October 30, 2026 — Briefing updated

This briefing was last reviewed and updated on October 30, 2026.

## Threat Group & Attack Vector

The code attempted SSH-key insertion, a reverse tunnel and persistent startup tasks. Errors and privilege requirements limited some backdoor functions, but did not eliminate key insertion, persistence or metadata collection. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1098.004 — SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004/): the extension attempted to add an attacker-controlled key for persistent access. [1](#source-1)

## Response

Cursor removed the package, rotated keys and rebuilt the marketplace; its audit found no other altered extensions. The hosting provider disabled the attacker’s server. Affected hosts require investigation and persistence cleanup; uninstalling alone is insufficient. Cursor advised considering rebuilds and rotating exposed credentials from a trusted device. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/cursor-claude-code-extension-compromise-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace

official · Cursor

<https://cursor.com/blog/claude-code-extension-security-notice>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Cursor Claude Code extension compromise: The extension attempted to install an attacker-controlled SSH key, enable a local SSH service, create a reverse tunnel, and establish persistence through a macOS LaunchAgent or Windows scheduled task and Startup entry.
2. **Occurred At · 100% confidence · current**  
   Malicious extension distributed and removed: 2026-10-29
3. **Affected Organization · 100% confidence · current**  
   Cursor Claude Code extension compromise: Cursor
4. **Resulted In · 100% confidence · current**  
   Cursor Claude Code extension compromise: Malicious extension distributed and removed
5. **Used Attack Technique · 100% confidence · current**  
   Cursor Claude Code extension compromise: https://attack.mitre.org/techniques/T1098/004/
6. **Resulted In · 100% confidence · current**  
   Cursor Claude Code extension compromise: Cursor said implementation errors and required administrator privileges prevented some SSH-service and backdoor-login actions on ordinary hosts, but key insertion, persistence and metadata transmission could still occur.
7. **Began At · 100% confidence · current**  
   Cursor Claude Code extension compromise: 2026-10-29
8. **Resulted In · 100% confidence · current**  
   Cursor Claude Code extension compromise: Cursor said a maliciously modified Anthropic.claude-code extension version 2.1.313 was distributed through its VS Code extension marketplace on October 29, about 02:27–13:35 PT, potentially affecting at most 5,000 users. The malicious package was not developed by Anthropic.
9. **Disclosed At · 100% confidence · current**  
   Cursor Claude Code extension compromise: 2026-10-29
10. **Resulted In · 100% confidence · current**  
   Cursor Claude Code extension compromise: The modified extension collected host and user metadata, including public IP, configured Git email, working directories and environment-variable names. The notice does not say that it collected all environment-variable values.
11. **Resulted In · 100% confidence · current**  
   Cursor Claude Code extension compromise: Cursor advised treating affected machines as potentially compromised, removing persistence and keys, considering rebuilding, and rotating accessible credentials from a trusted device. Uninstalling the extension alone is insufficient.
12. **Resulted In · 100% confidence · current**  
   Cursor Claude Code extension compromise: Cursor removed the package, temporarily closed its marketplace, rotated keys and rebuilt the service. Its audit found no other modified extensions. The attacker hosting server was taken offline with the hosting provider.

</details>