Malicious Claude Code extension briefly hit Cursor's marketplace

A tampered Claude Code extension was available in Cursor's VS Code extension marketplace on Thursday, Oct. 30, 2026, for about eleven hours and may have affected up to 5,000 users, according to Cursor. Anthropic had no involvement in developing it. The extension tried to harvest user data and attempted to set up remote access for an attacker.

What the extension tried to do

Cursor said the extension tried to harvest user data such as hostname, username, operating system, and public IP address. It also attempted to set up remote access for the attacker. Cursor said that remote access likely would not have worked on most machines because it requires admin privileges.

Cursor's response

Once the issue was discovered, Cursor pulled the extension and took the entire marketplace offline. After working with providers to neutralize the malware and confirming there was no further risk, the marketplace was reinstated. Cursor said no other extensions were affected.

Who was affected

The affected extension was described as a Claude Code extension for Cursor. Users who recently installed the Claude Code extension for Cursor were warned to pay attention to the incident. Cursor said Anthropic had no involvement in developing the extension.

Sources: The Decoder