Cursor removed backdoored Claude Code extension builds from its marketplace on October 29, 2026, after they attempted to compromise developer machines. Cursor’s security notice says versions 2.1.312 and 2.1.313 were available for about 11 hours; Sophos estimates up to 5,000 users may have been affected.
The payload tried to install an attacker-controlled SSH key, enable local SSH, open a reverse tunnel, persist outside the extension directory, and transmit host details. Cursor cautioned that successful remote access likely failed on most macOS and Windows systems because of permission requirements and code errors.
Uninstalling may not remove the persistence scripts. Cursor published remediation tools, advised isolating hosts showing execution evidence, removed the malicious releases, rotated marketplace keys, and rebuilt the marketplace. Microsoft said its extension marketplace and npm were not affected, while Anthropic said its systems were not compromised.