For about 11 hours on 29 October, developers using Cursor with the Claude Code extension may have received an update that looked completely normal. It had the same extension ID, the same publisher and the next version number.

It quietly tried to add an attacker's SSH key to their machine.

What happened

Cursor says malicious versions of the anthropic.claude-code extension were available in Cursor's own extension marketplace from about 02:27 to 13:35 PT on 29 October 2026 (09:27–20:35 UTC). Most reporting focused on version 2.1.313 . Cursor's security notice, updated on 30 October, lists 2.1.312 and 2.1.313 as affected, on Windows and macOS.

Key facts so far:

Anthropic did not build it. Cursor says so directly, and its investigation found no sign that the official distribution was affected.

It was only on Cursor's marketplace. Early reports also named Open VSX, Microsoft's Visual Studio Marketplace and npm.…