Day 7 receipt
Cursor Marketplace security notice (Claude Code extension)
Day 2 of 7Not a launch: a security notice Cursor posted on 29 Oct 2026 (updated 30 Oct) after a tampered Claude Code extension was served from its marketplace. We track the notice's checkable claims the same way. The headline user count comes from Cursor's X post on 30 Oct.
Cursor disclosed that a tampered copy of the Claude Code extension was served from its marketplace for about 11 hours on 29 Oct, and published checks and clean-up scripts.
Launch dayWhat they claimed, quoted word for word · 5
“These malicious versions of the extension were not developed by Anthropic.”
Anthropic staff say its systems were not compromised and the tampered build never reached its official channels; Microsoft confirms it was never on the Visual Studio Marketplace or npm.
“Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.”
Phorion's code analysis shows the macOS check fails without admin rights and the Windows path calls a Unix shell; Sophos and The Register agree. Phorion adds that a Mac with Remote Login already on is still exposed.
“We audited access and confirmed no other extensions were tampered with.”
Only Cursor can see its marketplace logs. No outside party has found another altered extension, but none has been able to check.
“Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.”
Microsoft, Phorion and Sophos each found the key and start-up scripts written outside the extension folder, so removing or updating the extension leaves them in place.
“We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users.”
The count is Cursor's own. Developers point to the 12-hour delay before extension auto-updates, which kept some machines from ever installing it.
Day 7What real users report · 5
A developer says none of their machines updated to the tampered version and credits the editor's notice that new versions only become eligible for automatic update 12 hours after publishing.
A commenter says extension updates normally wait 12 hours and need a reload before the new version runs, and that they noticed no update arrived that day.
A developer says they spent two hours resetting API keys and preparing to reimage a machine before learning the incident affected Cursor, not VS Code.
A commenter calls the reporting on the incident and Anthropic's messages poor, while saying the decision to publish an overriding new version number across all channels was correct.
After the attack a user asks for a setting that delays extension auto-updates by some days; Cursor staff reply that this is already possible for teams and individuals.
2 posts · 69 views as of 31 Oct · Open the source
OthersWhat outlets and testers say · 6
The firm that first caught it walks through the code: the macOS SSH check fails without admin rights and the Windows path has its own bug, but the key and persistence are still planted, and a Mac with Remote Login already on stays exposed.
“Official Claude Code Extension Compromise: Security Advisory” · Open the source
Confirms the packages never appeared on the Visual Studio Marketplace or npm and that all evidence points to the Cursor marketplace only; stresses that updating the extension does not remove artifacts written outside it.
“Inside a malicious Claude Code-branded extension and its persistent SSH backdoor” · Open the source
Reports a flaw in the malware kept it from fully establishing itself on most machines, and that Cursor did not answer how the tampered upload happened.
“A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices” · Open the source
Covers Anthropic's denial of any breach on its side and notes neither company has said how the package reached the marketplace; agrees installing the latest version does not clear the persistence.
“Anthropic: That Claude Code extension compromise… couldn't be us” · Open the source
Advises checking for the bad version in the exposure window; agrees SSH enablement fails on most Mac and Windows hosts and that uninstalling leaves the backdoor in place.
“Malicious Claude Code extension distributed through Cursor marketplace” · Open the source
Short news item restating Cursor's numbers, the exposure window and its statement that no other extensions were tampered with. Does not test anything.
“Cursor says around 5,000 people may have installed a malicious Claude Code extension.” · Open the source