Cursor issues security warning over malicious Claude Code extension

The AI coding agent developer Cursor has issued a formal security alert after a malicious version of Anthropic’s coding extension Claude Code was distributed via the official Cursor VSCode Marketplace.

Disguised as a legitimate Claude Code Extension update, version 2.1.313, the extension had been modified to run malware when installed that attempted to establish a persistent backdoor in user systems.

Cursor, which is a subsidiary of SpaceXAI, said it was observed collecting sensitive user data including username, hostname, operating system, home directory path, environment variable names, working directories, configured Git email, and public IP.

The malware was also configured to establish hacker-controlled SSH keys and a reverse SSH tunnel, to allow for permanent remote access to the user’s machine. In this instance, coding errors prevented this step from succeeding unless a user started Cursor with administrator privileges.

In response, Cursor temporarily shut down its VSCode Marketplace and removed the malicious extension. It urged those who installed or updated to the malicious version to search for indicators, rotate credentials and provided a cleanup script that removes the extensions and its persistence mechanisms.

Cursor added that up to 5,000 users were impacted by the malware and that it was directly reaching out to all of them.

Cursor became a subsidiary of SpaceXAI in August, through a $60 billion deal by the Elon Musk-led AI firm to acquire Cursor’s parent company Anysphere.