Fake Claude Code extension hit up to 5,000 Cursor users

A malicious version of the Claude Code extension was available through Cursor's extension marketplace for just over eleven hours on 29 October 2026, between 10:27 and 21:35 Paris time. In a security advisory published the same day, Cursor said the build, version 2.1.313, "was not developed by Anthropic" and was downloaded by at most 5,000 users, whom the company plans to contact directly.

What the extension did

Once installed, the extension profiled the machine. It collected the operating system, processor architecture, home directory path, the email address configured in Git and the public IP address, then sent everything to a server controlled by the attacker.

It then tried to secure lasting access. An SSH key named "svc-telemetry", embedded in the code and belonging to the attacker, was added to the list of authorized keys. The extension also attempted to enable the local SSH service and open a reverse tunnel, a connection initiated from the victim's computer to the attacker's server that lets the attacker return to the machine at will. A persistence mechanism was installed so the malware would survive reboots.

Partly botched, but not harmless

According to Cursor, errors in the malicious code made the tunnel fail, except in the very unusual case where Cursor had been launched with administrator privileges. Enabling the local SSH service requires those rights, which the extension does not have on most macOS and Windows machines.

Affected computers are not necessarily clean, though. Even when the tunnel failed, the extension still added the attacker's key, installed its persistence scripts and transmitted the machine information. Cursor says it worked with the cloud provider hosting the malicious server to take it offline.

The company removed the rogue version as soon as it was detected, blocked its distribution and then closed its whole extension marketplace as a precaution, while it checks that no other extension was compromised and rebuilds the store.

A central question remains unanswered: the advisory does not explain how the attacker managed to publish a version under Anthropic's name in Cursor's marketplace. Users who installed the extension on 29 October should treat their machines as potentially compromised.