Hackers Distribute Malicious Claude Code Extension on Cursor, but Attack Fails Due to Coding Errors — Big Tech and the digital economy

On October 29, 2026, a compromised version of the Claude Code extension was distributed via the Cursor editor's marketplace. While the malicious update targeted up to 5,000 developers by attempting to steal system data and establish remote access, critical errors in the code prevented the attack from fully succeeding on most machines.

On October 29, 2026, the extension marketplace for the Cursor code editor distributed a fraudulent update of Claude Code, Anthropic's programming assistant. The malicious version, identified as 2.1.313, was available online for approximately eleven hours between 10:27 and 21:35 Paris time before being removed. In a security advisory issued on the same day, Cursor confirmed that the extension was not developed by Anthropic and estimated that it was downloaded by a maximum of 5,000 users, whom the company plans to contact directly.

According to official communications, the primary objective of the compromised extension was to profile the victim's machine. Once installed, it collected sensitive information including the operating system, processor architecture, personal folder path, configured Git email address, and public IP address, sending this data to a server controlled by the attacker. The malware then attempted to establish persistent remote access by injecting an SSH key belonging to the attacker into the authorized keys list under the name "svc-telemetry." It subsequently tried to activate the local SSH service and open a reverse tunnel, allowing the attacker to initiate connections from the victim's computer back to their server at will. To ensure persistence across reboots, the extension also installed specific mechanisms to maintain its presence on the system.

However, the attack only partially succeeded due to errors in the malicious code. Cursor reported that the attempt to open the reverse tunnel failed in most cases, except in the highly unusual scenario where Cursor was launched with administrator privileges. Activating the local SSH service requires these elevated rights, which the extension lacked on most macOS and Windows computers. Despite the failure of the tunnel, affected machines were not entirely safe; the attacker's key was still added, persistence scripts were installed, and system information was exfiltrated even when the remote access attempt failed. Cursor stated it has worked with the cloud host to take the malicious server offline.

Following the detection, Cursor removed the malicious version immediately, blocked its distribution, and temporarily closed its entire extension marketplace as a precautionary measure. This shutdown allowed the company to verify that no other extensions were compromised before rebuilding the store. A central question remains regarding how the attacker managed to publish a version of the extension bearing Anthropic's name within the Cursor marketplace, as the security advisory did not explain the method used to bypass verification.

Sources: Numerama.