The Claude Code extension attack: what happened in Cursor?.

Yesterday I saw Cursor’s security notice: version 2.1.313 of the Claude Code VS Code extension briefly contained malicious code while listed in Cursor’s marketplace. Some headlines can make it sound as though Claude or all of Anthropic’s distribution was compromised. The details in Cursor’s notice are narrower: the incident involved one specific extension package in its marketplace.

Cursor says the affected version was not developed by Anthropic and that up to 5,000 users may have been exposed. The package was available in Cursor’s VS Code extension marketplace on October 29, between approximately 02:27 and 13:35 Pacific Time. So it would be inaccurate to say “the Claude model was hacked.” The issue was with the distribution of an extension package running inside the editor.

What did the extension try to do?

According to Cursor’s investigation, the modified package collected certain information about the computer and user: machine and user names, operating system and architecture, home and working directories, the email address configured in Git, public IP address and the names of environment variables. That last detail matters: the notice refers to the names of environment variables, not their values.

The package also tried to add the attacker’s SSH key, enable the local SSH service, and set up a reverse tunnel and persistence mechanisms for remote access. Cursor notes that enabling SSH generally requires administrator privileges the extension did not have on most macOS and Windows systems, so that step would usually fail. But that does not mean the other actions failed too: adding an SSH key, leaving persistence files and sending machine information remained separate risks.

Who should check their systems?

Cursor’s warning applies to people who installed or updated to Anthropic.claude-code version 2.1.313 from Cursor’s VS Code extension marketplace during the time window on October 29. This does not mean every person who used that version was definitely compromised; still, simply removing the extension and moving on may not be enough. The malicious code attempted to leave persistence files outside the extension itself.

If you used that version from that marketplace, follow the checks and cleanup steps in Cursor’s security notice. It recommends checking for unauthorized SSH keys and persistence artifacts, isolating a suspected machine from the network, and rotating potentially exposed credentials from a clean device. Cursor also says it will contact users it identified as affected.