Up to 5,000 Cursor users may have encountered a compromised extension that attempted to establish persistent access, exposing security risks in the software development tools engineers trust.
A maliciously modified version of Anthropic’s Claude Code extension was distributed through Cursor’s development environment marketplace, potentially exposing up to 5,000 users to a backdoor designed to provide unauthorized access to their computers.
The incident involved Claude Code extension version 2.1.313, which was available through the Cursor marketplace on October 29, 2026.
According to Cursor’s official security advisory, the malicious package was accessible between approximately 2:27 a.m. and 1:35 p.m. Pacific Time.
Cursor emphasized that the modified version was not developed by Anthropic and that there was no evidence other extensions or the official distribution were affected.
The incident highlights an increasingly important cybersecurity concern: trusted developer tools can become entry points for attackers even when the AI models themselves are not compromised.
Malicious Code Hidden Inside a Legitimate Extension
Security researchers discovered that the compromised package contained unauthorized instructions inserted into the extension’s normal JavaScript bundle.
An OpenSourceMalware investigation identified a 66-line malicious loader placed before the legitimate extension code.
The loader attempted to collect device information, including usernames, operating systems, public IP addresses, working directories and configured Git email addresses.
It also gathered names of environment variables that could indicate cloud credentials or other sensitive development configurations.
The malware attempted to install an attacker-controlled Secure Shell (SSH) key, enable remote access and establish persistent connections.
Importantly, researchers found that the malicious instructions could execute when the extension loaded, without requiring developers to begin a Claude conversation.
Attackers Target Persistent Access
An independent technical analysis by Phorion, published October 30 by security researcher Calum Hall, examined how the malicious package attempted to maintain access across different operating systems.
The research identified a flaw in the macOS implementation that could prevent successful SSH access when the service was not already enabled.
Cursor similarly reported that the attempted remote-access setup would fail on most affected computers because enabling the required services needed administrator privileges.
However, these implementation failures did not necessarily prevent installation of unauthorized SSH keys, persistence mechanisms or transmission of device information.
The distinction is significant: the 5,000-user figure represents the maximum potentially affected population, not 5,000 confirmed successful intrusions.
Cursor Removes the Compromised Package
Cursor removed the malicious extension, temporarily shut down its marketplace and rebuilt the distribution infrastructure.
The company also rotated relevant keys and worked with the hosting provider to disable the attacker’s server.
According to The Hacker News, Anthropic subsequently published version 2.1.314 to replace the compromised release.
Affected developers were advised to check for unauthorized SSH keys, persistence mechanisms and suspicious activity.
Cursor warned that uninstalling the extension alone might not eliminate malicious components installed separately.
AI Coding Tools Face a Supply Chain Security Test
For engineering teams, the incident demonstrates why software extensions deserve the same scrutiny as application dependencies and privileged infrastructure components.
Developer environments frequently contain source code, credentials, cloud integrations and access to production systems.
A compromised extension operating with a developer’s permissions may therefore expose substantially more than the application in which it runs.
Organizations increasingly need controlled extension installation, verified software updates, endpoint monitoring and restrictions on access to sensitive credentials.
The broader lesson is that securing AI development requires protecting the entire software supply chain—not merely evaluating whether an AI model behaves safely.
