Cursor pulls fake Claude Code extension after 5,000 users exposed
A tampered extension posing as Anthropic's Claude Code was live on Cursor's marketplace for about 11 hours and tried to open remote access.
Cursor said a malicious extension impersonating Anthropic's Claude Code was distributed through its VS Code extension marketplace and affected up to 5,000 users, according to a company disclosure reported by aitimes.com.
Cursor announced on October 30 that the tampered Claude Code extension had been registered and distributed on the marketplace the previous day. The malicious version was exposed for about 11 hours, from 2:27 AM to 1:35 PM on October 29.
According to Cursor, the extension attempted to collect system information including hostname, username, operating system and public IP address. It also tried to register an SSH public key named svc-telemetry and run a backdoor script to establish persistence and remote access.
The core remote access steps failed on most systems because administrator privileges were required, Cursor said. The company removed the malicious version immediately after discovery and blocked further distribution.
Cursor temporarily suspended marketplace operations and brought it back online after rebuilding the related systems. The company said the incident did not affect other extensions on the marketplace.
Quick answers
How many users were affected by the fake Claude Code extension on Cursor?
Up to 5,000 users were affected, according to Cursor.
How long was the malicious extension available?
It was exposed for about 11 hours, from 2:27 AM to 1:35 PM on October 29.
Did the attack succeed in gaining remote access?
Cursor said the core remote access steps failed on most systems because administrator privileges were required.