Cursor pulls a tampered Claude Code extension

Cursor's security notice on 29 October 2026 says a malicious build of the Anthropic.claude-code extension, version 2.1.313, was available in the Cursor extension marketplace. Cursor says Anthropic did not develop that package. The window was about 2:27am PT to 1:35pm PT that day, and Cursor says at most 5,000 users were affected.

Cursor says the package tries to install a persistent SSH backdoor. It collects host details, adds an SSH key, and attempts a reverse tunnel, and it tries to keep that tunnel running on macOS or Windows. Cursor says that on most hosts, turning on the local SSH service fails unless Cursor was started with administrator rights, so an attacker could not have logged in through the tunnel on those machines. The package can still add the key, install persistence, and send host details. Cursor says the attacker's server no longer works.

Cursor says it removed that version, shut the marketplace down, confirmed no other extensions were tampered with, rotated keys, rebuilt the marketplace, and worked with the hosting provider to take the server offline. It says it has no evidence that other versions of the extension, or the official distribution, were affected. The notice is where to check a machine and where to find the cleanup steps. Uninstalling the extension may leave persistence behind.

Who it's for: anyone who installed or updated Anthropic.claude-code to 2.1.313 from Cursor's marketplace during that window.

Fits: Best for Vibe Coding stays Cursor, for an agent in the editor. This note is one marketplace package, not that editing loop. The Cursor alternatives, the coding guide, and the Claude Code alternatives are unchanged. The verdicts are unchanged.