Breaking

Cursor Discloses Backdoored Claude Code Extension Served to Up to 5,000 Users

October 30, 2026 at 14:02 EDT

Security
Software Dev & Coding

Cursor's extension marketplace distributed a backdoored build of a Claude Code extension to as many as 5,000 users, according to reports, with the compromised version, 2.1.313, active for roughly 11 hours and reportedly installing an attacker's SSH key and persistence mechanism on affected machines.

Security incident · Cursor extension marketplace

A backdoored Claude Code extension build reached up to 5,000 users

Version 2.1.313 was reportedly active for about 11 hours, installing an attacker's SSH key and a persistence mechanism on affected machines. Cursor has said Anthropic did not build the compromised version.

5,000

Users reportedly affected (up to)

11 hrs

Time the rogue build was reportedly active

2.1.313

Compromised extension version

Scale of the reported exposure

Each figure is drawn on its own scale. Users and hours are different units and are not compared directly.

Up to 5,000 users

10 blocks = 5,000 (500 each)

About 11 hours live

11 blocks = 11 hours (1 per hour)

What the rogue build reportedly did

Step 1

Build distributed

Tampered Claude Code extension offered in marketplace

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.