The Cursor Marketplace allowed a malicious extension to be distributed, which contained a persistent SSH backdoor.

Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html

When Claude Code attacks! 😱 Cursor has confirmed that a malicious Claude Code extension was available through its extension marketplace, potentially affecting up to 5,000 users. The extension runs malicious code that attempts to install a persistent SSH backdoor. 👀 more coverage: https://socket.dev/blog/claude-code-extension-compromise