A bad Claude Code update hit at most 5,000 Cursor users

Researchers report that attackers put a bad version of the Claude Code extension in the Cursor marketplace on 29 October 2026. The update, version 2.1.313, is an add-on for an editor. It used the publisher name of the extension and tried to add a key for SSH, a tool for remote access. Cursor reports that a maximum of 5,000 users installed it and closed its marketplace for a short time.

How it works

It added a key with a safe name to the SSH key file of the user. It then tried to open a tunnel to a server of the attacker and to keep the access after the computer starts again.

It also sent host data to the attacker. The data had the names of environment variables that point to a key or a password.

The numbers

• The bad version is 2.1.313. Anthropic released repaired version 2.1.314.
• Researchers saw no other payloads.

Cursor reports that remote access works only with admin rights. The code does not have them on most computers.

What is not known

It is not clear how the attackers got in.

Cursor says that the version did not come from Anthropic.

Jenn Gile of OpenSourceMalware says this is not the key point, because the attackers used the same ID. Users with auto update on could have got the bad version.

Insight: Attackers use the trust in the Claude name

On 9 October, a Claude page made by attackers used an ad and a copy button that put a different command on the clipboard. Then a bad update came with the ID of Claude Code. This reads as attackers who use the trust in the Claude name at each step, from the ad to the update system. Auto update gives them speed. Leaders must know who approves extensions for AI tools.