Malicious Claude Code extension targets Cursor users in supply chain attack

Cursor users were targeted by a malicious, tampered copy of Anthropic’s Claude Code extension in a supply chain incident believed to have been carried out by abusing Cursor’s marketplace. The tainted extensions, versioned 2.1.312 and 2.1.313, appeared on the Cursor VS Code Extension Marketplace for around 11 hours on 29 October 2026 and were designed to run code during module loading to perform host reconnaissance and other actions.

Security researcher Kevin Beaumont notes that roughly 5,000 developer machines may have downloaded the malicious versions. Anthropic stated that the modified code was not developed or published by the company, and the official channels remained unaffected. Cursor promptly removed the extension, suspended the marketplace, and worked with its cloud provider to take the attacker’s server offline; Anthropic subsequently released a legitimate update to Claude Code, version 2.1.314.

Microsoft’s security notes describe the loader’s behaviour: it collects host information (hostname, username, OS, architecture, working directory, and global Git email), deploys platform-specific scripts, installs persistence mechanisms, and attempts to enable SSH and create a reverse SSH tunnel. The extension’s loader aimed to perform these actions during module load, with a later callback intended to send host details.

Cursor reported that, because enabling the local SSH service requires admin rights and the extensions lacked these privileges on most macOS and Windows systems, the reverse-SSH step often failed, preventing attacker access through the tunnel. Cursor and Microsoft advise removing the malicious extensions, identifying IoCs, and isolating or reimaging affected hosts; Cursor also provided a detection script and indicators of compromise.