Cursor identifies malicious Claude Code extensions

Cursor’s notice concerns macOS and Windows installations from its marketplace on October 29, between 2:27am and 1:35pm Pacific time. Cursor removed the packages and took the attacker’s server offline with its hosting provider. Uninstalling alone may leave persistent components behind; affected users should follow the notice’s investigation and remediation guidance, including credential rotation from a trusted system.

Phorion’s analysis explains why a coding extension matters: it inherits the editor user’s permissions, potentially exposing local files and development tools. On a Mac without remote login already enabled, a permission-checking bug can prevent the attempted remote access. That does not remove planted keys or persistence, and is no dependable defence. Investigators must distinguish an established connection from an attacker actually logging in; those are different observations about a machine.

In Ars Technica’s reporting, researcher Luke Roberts described access to the official distribution channel, rather than simply a misleadingly named alternative. He said Cursor extensions update automatically by default, although users can configure that setting. The report also documents an unresolved question: how the account was accessed. At publication on October 30, Ars said neither company had answered its questions and Anthropic had not publicly notified customers.