← All reports

A tampered Claude Code extension was distributed via the Cursor marketplace, potentially compromising up to 5,000 users.

CybersecurityAITechnologyConflictOct 30, 2026score 0.272 posts · 0 replies across 2 instances
A tampered version of the Claude Code extension was distributed through the Cursor marketplace for approximately 11 hours, affecting up to 5,000 users. The malicious update attempted to plant an SSH key and harvest sensitive environment variables and Git emails. Cursor has since removed the extensions and rotated its keys.

Claims

A tampered Claude Code extension was distributed via the Cursor marketplace, potentially compromising up to 5,000 users.
Parent: CybersecurityEntity: Cursor marketplaceSub-entity: Claude Code extensionImpact: negativeDate: Oct 30, 2026 - Oct 31, 2026Target: The security incident involving the tampered Claude Code extension in the Cursor marketplace.

Source posts

@[email protected]
A tampered Claude Code extension, version 2.1.313, was live in Cursor's marketplace for about 11 hours and reached up to 5,000 users. It carried Anthropic's real extension ID, so it arrived as a normal update. Cursor says a key backdoor step needs admin rights. #Cybersecurity #AI #ClaudeCode #Cursor
0 boosts · 0 favs · 0 replies · Oct 30, 2026
#cybersecurity#ai#claudecode#cursor
@[email protected]
A tampered copy of Anthropic's Claude Code extension sat in Cursor's marketplace for about 11 hours on 29 October, reaching up to 5,000 users. It tried to plant an SSH key and open a reverse tunnel to the attacker's server, harvesting hostnames, Git emails and the names of up to 40 secret-holding environment variables. Cursor pulled the extensions and rotated its keys. https://thenextweb.com/news/tampered-claude-code-extension-cursor-ssh-backdoor #Tech #Startup #News #AI
0 boosts · 0 favs · 0 replies · Oct 31, 2026
#tech#startup#news#ai