Malicious extension briefly available

On October 29, 2026, a harmful version of the Claude Code extension was made available for download through the Cursor extensions store. The malicious code was designed to gain unauthorized access to users' computers.

Short duration of the threat

The malicious extension was online for just over eleven hours, between 10:27 and 21:35 Paris time. It was later removed after being identified as a security risk.

Limited number of users affected

According to a security notice, version 2.1.313 of the extension, which was not developed by Anthropic, had been downloaded by a maximum of 5,000 users. Cursor plans to contact these users directly.

Information collected by the extension

The extension aimed to create a profile of the machine, collecting details such as the operating system, processor architecture, personal folder path, email address configured in Git, and the public IP address. This data was sent to a server controlled by the attacker.

Attempt to gain persistent access

The malicious code tried to establish lasting access to the computer using an SSH key named "svc-telemetry" belonging to the attacker. This key was added to the list of authorized keys on the machine.

Partial failure due to coding errors

The attack partially failed due to errors in the malicious code, which caused the tunnel to fail except in the rare case where Cursor was started with administrator privileges. Most macOS and Windows computers do not grant this level of access to extensions.

Persistence and remaining risks

Despite the partial failure, the extension still added the attacker's key, installed persistence scripts, and transmitted information about the machine. These actions left the affected computers at risk.

Actions taken by Cursor

Cursor worked with the cloud host of the malicious server to take it offline, removed the malicious version, blocked its distribution, and closed its entire extensions store as a precaution until it verified no other extensions were compromised.

Unresolved question about the attack

A central question remains: the notice does not explain how the attacker managed to publish, in Cursor's store, a version of the extension bearing the name of Anthropic.