Malicious Claude Code extensions in Cursor planted persistent backdoor components
Malicious Claude Code extensions in Cursor potentially exposed up to 5,000 developers. Distribution has stopped, but affected computers need investigation and cleanup: updating or uninstalling the extension alone does not remove its backdoor components.
If anyone in your family uses Cursor with Claude Code, ask their IT team to check for the malicious marketplace builds, including automatic updates. If affected, disconnect the computer and follow Cursor’s macOS or Windows cleanup guidance, remove the unauthorised remote-access components, and rotate accessible credentials and sessions from a trusted device. Updating or uninstalling the extension alone is insufficient.
What’s happening
Cursor’s extension marketplace distributed malicious Claude Code builds 2.1.312 and 2.1.313 for macOS and Windows on 29 October. BleepingComputer reported potential exposure of up to 5,000 developers; this is not a confirmed infection count. The malware added an attacker’s remote-login key, installed components that could restart automatically and sent computer and user details. Coding errors and missing administrator permissions prevented remote access on many systems, but did not prevent all malicious activity. Microsoft found that the initial reporting sent environment-variable names rather than their secret values. Cursor removed the packages, rebuilt its marketplace and said the attacker server was taken offline. Expel nevertheless recorded outgoing tunnel activity on 30 October; the takedown’s exact timing is unknown. As at 3 November, affected computers still require cleanup and investigation. This is malicious software rather than a flaw resolved by a routine update, and the reviewed sources do not establish how many devices attackers successfully accessed.
- What
- Poisoned software
- Affects
- Claude Code extension in Cursor’s extension marketplace
- Affected
- Malicious Anthropic.claude-code 2.1.312 and 2.1.313 builds distributed by Cursor’s marketplace for macOS and Windows on 29 October 2026, approximately 02:27–13:35 Pacific Daylight Time
- Fixed in
- Nothing to patch
- Since
- 29 Oct 2026
Timeline
- Vendor revised
Cursor revised its notice to include malicious version 2.1.312 alongside 2.1.313 and corrected its indicators of compromise.
- Update
One customer Mac first showed malicious activity about eight hours after distribution ended. Expel observed its tunnel connecting out until 14:29 UTC, but did not observe attacker logins.
- Update
Microsoft confirmed that its Visual Studio Marketplace and the npm Claude Code package were unaffected. It said Anthropic had confirmed its own systems were not compromised.
- Update
Cursor stopped distributing the malicious builds after approximately 11 hours.
- UpdateNothing to patch
Cursor’s marketplace began distributing malicious Claude Code extension builds 2.1.312 and 2.1.313 for macOS and Windows.
- Made public
Cursor disclosed the incident. It said it had rotated keys, rebuilt and reopened its marketplace, and arranged the attacker server’s takedown; the takedown time was not specified.
Sources
- Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension MarketplaceCursor · 30 Oct 2026
- Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMicrosoft · 30 Oct 2026
- Malicious Claude Code extension on Cursor planted SSH backdoorsBleepingComputer · 30 Oct 2026
- Fake Claude Code extensions in Cursor: Malicious activity after the exposure windowExpel · 30 Oct 2026