---
type: "post"
id: "malicious-claude-code-extension-v2-1-313-hit-d4c504"
slug: "malicious-claude-code-extension-v2-1-313-hit-d4c504"
title: "Malicious Claude Code extension v2.1.313 hit Cursor's marketplace, exposing up to 5,000 developers."
description: "Cursor identified a malicious build of a Claude Code extension in its VS Code extension marketplace on October 29, 2026."
retrieval_nugget: "Cursor identified a malicious build of a Claude Code extension in its VS Code extension marketplace on October 29, 2026. The package could leave persistence and an unauthorized SSH key on developer machines, making this a practical reminder that an IDE extension is executable code inside a privileged local environment."
published_at: "2026-10-30"
updated_at: "2026-10-30"
record_date: "2026-10-30"
date_kind: "published_at"
topics: ["claude","claude-code","anthropic"]
entities: ["Cursor","Cursor Extension Marketplace","Claude Code","Anthropic","Visual Studio Code"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "same_event"
what_changed: "Same event as We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users."
prior_refs: ["memory:4313b563-f4ab-8c4d-abc7-a05d1094308f"]
source_url: "https://cursor.com/blog/claude-code-extension-security-notice"
source_urls: ["https://cursor.com/blog/claude-code-extension-security-notice"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:malicious-claude-code-extension-v2-1-313-hit-d4c504"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/malicious-claude-code-extension-v2-1-313-hit-d4c504/","markdown":"https://newruntime.com/posts/malicious-claude-code-extension-v2-1-313-hit-d4c504.md","json":"https://newruntime.com/posts/malicious-claude-code-extension-v2-1-313-hit-d4c504.json"}
---

# Malicious Claude Code extension v2.1.313 hit Cursor's marketplace, exposing up to 5,000 developers.

## Retrieval answer

Cursor identified a malicious build of a Claude Code extension in its VS Code extension marketplace on October 29, 2026. The package could leave persistence and an unauthorized SSH key on developer machines, making this a practical reminder that an IDE extension is executable code inside a privileged local environment.

## Summary
Cursor identified a malicious build of a Claude Code extension in its VS Code extension marketplace on October 29, 2026. The package could leave persistence and an unauthorized SSH key on developer machines, making this a practical reminder that an IDE extension is executable code inside a privileged local environment.

## What happened
Cursor said it identified a security incident involving version 2.1.313 of the `Anthropic.claude-code` extension in the Cursor VS Code extension Marketplace. The company says the malicious version was not developed by Anthropic and that no more than 5,000 users were affected. It was available between approximately 2:27am PT and 1:35pm PT on October 29, 2026.

According to Cursor's notice, the modified extension collected host and user information: hostname, username, operating system, architecture, home-directory path, environment-variable names, working directories, configured Git email, and public IP. It also attempted to add an attacker-controlled SSH public key, labelled `svc-telemetry`, to authorized keys; enable the local SSH service; and create a reverse SSH tunnel. The extension reported host details and backdoor status to an attacker endpoint through an HTTP POST request.

The package also attempted persistence. On macOS, it used a LaunchAgent; on Windows, it attempted to create a scheduled task running as SYSTEM, with a Startup-script fallback. Cursor says background scripts retried the tunnel roughly every 60 seconds. The company notes that, except in unusual cases where Cursor had been started with administrator privileges, errors in the malicious code meant the SSH-service step would fail. On those hosts, the attacker could not log in through that tunnel. Cursor nevertheless says the extension still added the unauthorized key, installed persistence, and sent host details, so affected users should follow remediation guidance.

Cursor removed the malicious version, blocked further distribution, shut down the VS Code Marketplace while it investigated, audited access, rotated keys, rebuilt the marketplace, and restored it. It also worked with the hosting provider to take the attacker server offline; Cursor says the reverse shell and host-detail POST are therefore no longer functional. The company says it found no evidence that other extension versions or the official distribution were affected.

For people who installed or updated that specific package during the stated window, Cursor recommends searching endpoint, network, and extension-installation telemetry for its indicators; isolating hosts showing payload execution or backdoor installation; removing the SSH key, persistence mechanisms, and tunnel processes; and deciding whether a host should be rebuilt. It warns that uninstalling the extension alone may not remove standalone persistence scripts. It also advises rotating credentials and sessions accessible from an affected machine from a trusted system.

## What the archive adds
This is a new security fact on a known extension-distribution story. In [Claude Marketplace: plugins and connectors, products and agents, and service partners](https://newruntime.com/posts/claude-marketplace-plugins-and-connectors-products-and-agents-90e32f/), we described Anthropic's marketplace direction as an integration and procurement layer. Cursor's incident shows the distinct operational risk when extension distribution reaches developer workstations.

## Trend signal
This supports [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). The critical issue was not an unsafe instruction to a model: a marketplace package executed on a local machine and attempted to alter SSH access and operating-system persistence. Security controls must therefore cover install, execution, permissions, telemetry, and cleanup at the runtime boundary.

## Why now
The incident is immediately actionable because the malicious package was removed and its command-and-control server was taken offline, but those actions do not erase artifacts already written to a machine. Cursor explicitly says that uninstalling the extension may be insufficient and provides platform-specific remediation scripts and indicators for the affected version.

## Connections to other events
The earlier [Claude Marketplace: plugins and connectors, products and agents, and service partners](https://newruntime.com/posts/claude-marketplace-plugins-and-connectors-products-and-agents-9096d6/) Field Note framed marketplaces as a distribution and procurement layer for enterprise AI tooling. This event does not establish a problem with that marketplace itself, but it makes the endpoint consequence of third-party extension distribution concrete: packages can reach developer machines with the ability to execute local code.

## Why it matters
Teams increasingly put coding assistants, connectors, and extensions in the same environments that hold source code, cloud credentials, SSH keys, and developer sessions. That makes extension provenance and post-install visibility part of the engineering security surface, not merely IDE administration. The relevant response is narrower and more operational than abandoning extensions: know which package version was installed, retain endpoint and network telemetry, test whether removal actually removes persistence, and have a credential-rotation path for machines that may have been accessed.

For security and platform teams, this incident also distinguishes package removal from host remediation. A marketplace operator can stop new downloads and disrupt an attacker server, while an installed package may already have changed local authorization or scheduled future execution. Asset inventory, endpoint detection, and a documented rebuild decision are what turn an advisory into a bounded response.

## What happens next
- **Teams will add extension-version inventory and integrity checks to developer-endpoint response playbooks.** (3 months, 70%). Watch for: published internal controls or marketplace tooling that exposes installed-package provenance.
- **Marketplace operators will face pressure to make publisher and package verification more visible.** (6 months, 60%). Watch for: new signing, audit, or review requirements for extension publication.

## Limits and uncertainty
Cursor's notice is the source for the incident details and impact estimate. It does not explain how the malicious package entered the marketplace, identify an attacker, or establish whether a particular affected machine was successfully accessed after installation. The statement that no more than 5,000 users were affected is an upper-bound estimate, not a count of compromised hosts. Cursor says it found no evidence that other versions or the official distribution were affected; that is not the same as an independently verified finding. Teams should use the supplied indicators and their own telemetry to assess individual endpoints.

## Skill to build now
Run an extension-response drill for developer machines this week. Pick one approved IDE extension and document: its publisher and version, where installed files live, which local credentials or services it can reach, the logs that would show its network activity, and how to remove it plus any persistence it could leave behind. Then test the difference between uninstalling the extension and restoring a clean endpoint state. The exercise makes a future advisory faster to scope and less dependent on improvised commands.

## Reader takeaway
A malicious IDE extension is not just a bad dependency update: it can become a local-machine incident. If your team installed Cursor's `Anthropic.claude-code` version 2.1.313 during the stated October 29 window, check for the published indicators and remediate the host rather than relying on uninstall alone.

## Open question
How did the malicious build enter the Cursor marketplace, and what additional publication controls will Cursor introduce to prevent a recurrence?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Claude Code](https://newruntime.com/topics/claude-code.md): Explore the claude-code topic hub.
- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)