Cursor pulls malicious Claude Code extension, warns uninstalling may leave malware behind

Removing a malicious Claude Code extension may not be enough to clean affected computers, Cursor warned in an October 29 security notice. The company pulled the package from its marketplace after it attempted to install persistent remote access. Cursor says at most 5,000 users were affected and that it will contact them directly.

The malicious package, identified as Anthropic.claude-code version 2.1.313, was available through Cursor’s VS Code extension marketplace from about 2:27 a.m. to 1:35 p.m. PT on October 29, 2026. That left it available for roughly 11 hours before removal. Cursor says this version was not developed by Anthropic.

Cursor said it found no evidence that other versions or the official distribution were affected. Its findings concern this particular package, rather than Claude Code as a whole. The company’s response included both stopping distribution and disabling the server used by the attacker.

A remote-access attempt with a critical permission limit

The payload collected computer and user details, including the hostname, username, operating system, home-directory path, configured Git email and public IP address. Its listed collection also included environment-variable names—the labels used for settings—not their values. It sent host information and backdoor status to an attacker-controlled server.

For remote access, it attempted to add an attacker-controlled SSH key, enable the computer’s SSH remote-login service and open a reverse tunnel back to the attacker. Cursor says enabling that service requires administrator rights, which the extension lacked on most macOS and Windows machines. Errors in the malicious code further limited that step.

On those hosts, Cursor says, the attacker could not have logged in through the tunnel. But the extension still added the attacker’s key, installed persistence and sent host details. It attempted to keep the tunnel running through a macOS LaunchAgent or a Windows scheduled task, with a Windows Startup-script fallback. Background scripts retried roughly every 60 seconds.

Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running.

Cursor security notice, October 29, 2026

Marketplace restored, attacker server disabled

Cursor removed the malicious version and blocked further distribution, then temporarily shut down its extension marketplace as a precaution. It audited access, said it confirmed no other extensions had been tampered with, rotated its keys and rebuilt the marketplace before bringing it back online.

The company also worked with the attacker’s hosting provider to take the server offline. Cursor says that made the reverse connection and host-detail reporting nonfunctional. Its instructions nevertheless call for affected users to remove the local changes and investigate their computers.

Check the machine, then clean and rotate

Users who installed or updated to the affected version during that window should follow Cursor’s remediation instructions. The notice provides macOS and Windows checks for an unauthorized SSH key labeled svc-telemetry. Finding that key means the machine is impacted, Cursor says. The notice also lists package hashes, network addresses, files and process commands for security teams to investigate.

• Isolate computers showing evidence that the payload ran or installed a backdoor. Review endpoint, network and extension-installation records for the listed indicators.
• Remove the unauthorized SSH key, persistence mechanisms and running tunnel processes. Cursor supplies cleanup scripts for macOS and Windows, and advises assessing whether an affected machine should be rebuilt.
• Rotate credentials and sessions accessible from affected computers, using a trusted system. Cursor cautions that the limited environment-variable collection does not rule out later credential access through the backdoor.