What changed: Cursor found a tampered Claude Code extension — not built by Anthropic — live in its VS Code marketplace for roughly 11 hours on Thursday. The extension tried to collect hostname, username, OS, and public IP address, and attempted to set up remote access for an attacker. Cursor removed the extension, briefly took the marketplace offline, and restored it after neutralizing the malware.
Who is affected
Up to 5,000 users who downloaded the Claude Code extension from Cursor's VS Code marketplace; the source does not specify further scope.
What it means for your business
For businesses using Cursor and its Claude Code extension, this means installing third-party IDE extensions without verifying their source can expose device and network data to attackers.
What to do
If you use the Cursor VS Code extension, check when you installed the Claude Code extension, reinstall the official version if you updated during Thursday's incident window, and follow the remediation steps Cursor published.
When it takes effect
The source gives no exact date, only 'Thursday'; the incident lasted about 11 hours before the extension was pulled and the marketplace restored.
Source (press reports): The Decoder, Wired
