Trojanised Claude Code extension steals developer data via Cursor

Cursor disclosed that Anthropic’s Claude Code extension for the VS Code Marketplace was hijacked and swapped with a malicious variant, 2.1.313, during an 11‑hour window on 29 October 2026 GMT. The attack mirrors SolarWinds in miniature and resulted in data exfiltration from infected machines and, in a minority of cases, persistent, privileged access. Cursor estimated at most 5,000 users were affected and said affected developers would be contacted directly.

A separate, unrelated Cursor exploit was described on the same day, enabling arbitrary code execution on developers’ machines via Cursor’s built‑in browser.

Analysis of the Claude Code incident, described by researchers via OpenSourceMalware, shows the attacker inserted a 66‑line loader into the top of the legitimate extension’s code (extension.js). Once loaded, it attempted to add an attacker‑controlled key to victims’ SSH configurations to establish reverse tunnels back to the attackers.

The loader also attempted to achieve persistence by registering background processes: LaunchAgent on macOS, scheduled tasks with system privileges on Windows, and a fallback Startup script. Cursor noted that administration rights would typically be required to enable a local SSH service, which the extension would rarely possess.

In addition to backdoor activity, the malicious code exfiltrated hostnames, usernames, OS details, OS architecture, home directory paths, environment variable names, working directories, configured Git emails, and public IP addresses.

Cursor’s response included rotating keys, inspecting other extensions for tampering, temporarily taking the marketplace offline, and coordinating with the hosting provider to dismantle the attacker’s infrastructure. Researchers emphasise the ongoing risk from insecurities in IDE extensions and note that two separate, high‑risk threads emerged the same day: the trojanised Claude Code extension and the built‑in browser vulnerability.