# Cursor / Claude Code Extension Compromise Investigation Canonical overview: https://hallattorneys.com/investigations/cursor-claude-code Published: October 30, 2026 Last reviewed: October 30, 2026 Cursor extension marketplace · October 29, 2026 incident Hall Attorneys is investigating Cursor’s disclosed security incident involving a maliciously modified Claude Code extension distributed through its extension marketplace on October 29, 2026. Cursor says at most 5,000 users were affected. We are reviewing potential privacy and consumer claims, including concerns about unauthorized access, credentials, and the costs of responding. Did you install or automatically update Claude Code through Cursor’s marketplace during the reported window, receive an incident notice, or incur related response costs? You may request a case review even if you have not identified a financial loss. Start with a brief description of what happened. ## What has Cursor disclosed? Cursor’s October 29 security notice identifies the modified package as Anthropic.claude-code version 2.1.313. It was available through Cursor’s marketplace from approximately 2:27 a.m. to 1:35 p.m. Pacific time on October 29, 2026 (09:27–20:35 UTC). Cursor says it will contact affected users directly. Cursor reports removing the package, temporarily closing and rebuilding its marketplace, rotating keys, and working with the hosting provider to disable the attacker’s server. Restoring the marketplace does not establish that every affected computer has been cleaned or that all consequences have been resolved. In its official X post, Cursor says the malicious version was not developed by Anthropic and asks customers to update Claude Code for VS Code to version 2.1.314. The figure of at most 5,000 users is Cursor’s estimate; it does not establish successful remote access, stolen credentials, or financial loss for every user. Sources: Cursor: Official security notice and affected installation window: https://cursor.com/blog/claude-code-extension-security-notice Cursor: Incident announcement and version 2.1.314 update guidance: https://x.com/cursor_ai/status/2116074289053175808 ## What could the modified extension do? OpenSourceMalware’s analysis describes malicious code inserted ahead of the extension’s legitimate code. Loading the extension could execute that code without the user starting a Claude conversation. The code attempts to add an unauthorized SSH key, create a remote-access tunnel, retain access through background tasks, and send computer and user details to the attacker. SSH is a method of remotely signing in to a computer. The researchers describe collection of host information, a configured Git email address, and environment-variable names. They distinguish those names from secret values in the initial transmission. That distinction does not rule out later access to sensitive information if an attacker obtained remote access. Successful access depends on the device’s configuration and privileges; the presence of malicious code alone does not establish what was accessed on an individual machine. Sources: OpenSourceMalware: Analysis of the modified Claude Code extension: https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor ## Does this affect every Claude Code or VS Code user? This investigation concerns the modified 2.1.313 package distributed through Cursor’s marketplace. OpenSourceMalware’s updated report identifies Cursor as the distribution source and distinguishes the official npm package, Open VSX extension, and Microsoft VS Code Marketplace extension from the malicious artifact. The extension name alone does not establish that a particular installation was affected. We are examining how the modified package reached users, marketplace safeguards, warnings and notification timing, the response, and documented consequences. The sources reviewed do not establish that Anthropic’s official distribution was compromised or identify how the attacker introduced the package into Cursor’s marketplace. Legal responsibility remains under investigation. Sources: OpenSourceMalware: Updated distribution-source findings: https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor ## Who should contact Hall Attorneys? We would like to hear from developers, subscribers, account holders, and organizations with information suggesting an affected installation, particularly those who: - Installed or automatically updated Anthropic.claude-code 2.1.313 through Cursor’s marketplace during the reported October 29 window. - Received an incident notice or an IT or security alert identifying the modified extension, an unauthorized SSH key, or related activity. - Experienced suspected account access, credential misuse, disclosure of private information, service interruption, or related losses and have records suggesting a connection. - Spent time or money investigating a potentially affected device, replacing credentials, restoring systems, or obtaining security assistance. You do not need a direct notice or known financial loss to request a review. Using Cursor or Claude Code by itself does not establish that you were affected. We have not determined that every affected device exposed repositories, credentials, or customer records. Suspicious activity alone does not establish a connection to this incident. An initial inquiry does not identify you publicly as a client or plaintiff. Tell us whether you are contacting us as an individual or an authorized representative of an organization. ## What should affected users do and preserve? Cursor warns that uninstalling the extension alone may leave malicious components behind. Its notice provides platform-specific checks and cleanup instructions, recommends isolating hosts showing evidence of execution, and advises rotating accessible credentials and sessions from a trusted system. Follow the current official guidance with your IT or security team; an extension update alone is not proof that an affected device is clean. When safe, keep installation and update records, the extension identifier and version, the marketplace used, dates and time zones, incident notices, support tickets, security findings, and records of response costs or losses. Preserve existing logs through your security team. Do not delay containment or remediation to collect material for a legal inquiry, and do not reinstall or run the modified package to document it. Do not send passwords, API tokens, private SSH keys, recovery phrases, environment files, private source code, customer records, or raw logs containing secrets in an initial email or website submission. Describe the records you have before sending them. You do not need to install software, connect an account, or provide remote computer access to request a case review. Sources: Cursor: Current detection and remediation instructions: https://cursor.com/blog/claude-code-extension-security-notice ## Contact Hall Attorneys Provide your name, state or country of residence, a safe way to reach you, whether the installation was personal or work-related, and a brief description of your concern. If known, include the extension version, installation source, approximate installation or update time, and whether you received a notice. Let us know whether it is safe to leave a voicemail. Keep sensitive technical records in your possession until we discuss what is needed and an appropriate way to provide them. For immediate incident-response questions, use Cursor’s official security notice and your organization’s security team. Email: nhall@hallattorneys.com Phone: 713-428-8967 Request a Case Review: https://hallattorneys.com/connect Attorney Advertising. Responsible attorney: Nicholas Hall, Hall Attorneys, P.C., Edna, Texas. Hall Attorneys is not affiliated with Cursor, Anthropic, or Microsoft. This page describes an investigation, not a filed lawsuit by Hall Attorneys concerning this incident. Individual exposure, legal responsibility, and compensation have not been determined. It provides general information, not legal advice. Contacting the firm or submitting information does not create an attorney-client relationship. No outcome is guaranteed.