What happened
Cursor’s notice says a modified Anthropic Claude Code extension was available on its marketplace for Windows and macOS between about 2:27 a.m. and 1:35 p.m. Pacific on October 29, 2026. The injected code collected host details, tried to add an attacker SSH key labeled svc-telemetry, enable SSH, open a reverse tunnel, and persist via LaunchAgent or a scheduled task. Cursor says enabling SSH usually needs admin rights the extension lacks, so that step failed on most hosts, but the key, persistence, and host-detail POST could still land. Microsoft’s October 30 security post says the malicious packages were not on the Visual Studio Marketplace or npm the npm Claude Code package.
Why it matters
Teams treating Claude Code as a trusted loop still depend on the marketplace that delivers the extension. The useful habit is the same as reading a model claim: name the publisher, the version, and what the install path can touch. Cursor’s remediation scripts target the key, the persistence files, and the tunnel processes — not only the extension folder.
Cursor published SHA-256 hashes for the modified VSIX packages on darwin-arm64 and win32-x64 for both versions.
The notice was updated October 30, 2026 at 11:30 a.m. PT with clarified IOCs and affected versions.
Cursor’s October 30 post puts the impact at most 5,000 users.