The Hacker News

Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

A compromised Claude Code VS Code extension added an SSH key, installed persistence, and sent host details before version 2.1 ...

Cursor flags malicious Claude Code extension, up to 5,000 users affected

Cursor detected a tampered version of Anthropic's Claude Code extension, risking user data and remote access.
News9Live on MSN

Claude Code extension hacked: SSH backdoor puts 5,000 Cursor users potentially at risk

A malicious version of the Claude Code extension reportedly contained hidden code capable of opening remote access to ...
Unite.AI

Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension

Cursor on October 29, 2026 disclosed a security incident involving a maliciously modified version of the ...
The News International

Malicious Claude Code extension hit Cursor: 5,000 at risk

For about 11 hours on Thursday, a counterfeit version of Anthropic's Claude Code sat in Cursor's extension marketplace, one ...

[Action Required] Malicious version (2.1.313) of Cursor's Claude Code extension: Affected times in JST and how to check/remove it in 1 minute

On October 29, 2026, the AI code editor Cursor announced that version 2.1.313 of the "Anthropic.claude-code" extension, ...
Help Net Security

Claude Code extension poisoned with persistent SSH backdoor

According to Cursor, turning on SSH requires admin rights the extension lacks on most Mac and Windows hosts, and on those machines the attacker could not have logged in through the tunnel. The company ...
NewsBytes

Malicious Claude Code extension hits 5,000 Cursor users

Cursor, owned by SpaceX, temporarily shut down its extension marketplace after discovering a malicious Claude Code extension ...