Cursor says up to 5,000 users affected by tampered Claude Code extension

Recent coverage from outlets including Reuters, The Hacker News, Help Net Security, Inshorts, Rescana, and Step Security details a security incident involving a tampered software extension. Specifically, the official Claude Code extension on the Cursor marketplace was compromised with a Trojan horse package identified as version 2.1.313. According to reports, this malicious update planted a persistent Secure Shell backdoor directly onto developer machines. Coverage indicates that the fraudulent extension remained live and accessible to users for a total duration of eleven hours before being addressed. Reporting across these various publications heavily emphasizes the mechanics of the breach and the rapid response from platform monitors.

Inshorts notes that Cursor detected the fake artificial intelligence extension opening a secret door for malicious actors. Meanwhile, technical analyses from Step Security, Rescana, and Help Net Security break down how the poisoned extension functioned to compromise developer environments. Reuters anchors the broader impact by citing statements from Cursor regarding the scale of the exposure, confirming that as many as five thousand individual users may have been affected by the tampered installation during its operational window. This incident sits within the broader context of software supply chain vulnerabilities targeting developer marketplaces and integrated development environments. The deployment of a backdoor through a trusted extension channel highlights ongoing risks associated with third-party software components used in software engineering workflows.

Coverage does not yet specify the exact initial vector used by the attackers to compromise the extension listing, nor does it detail the full extent of unauthorized access obtained on the affected machines beyond the establishment of the persistent SSH backdoor. Future updates will likely track further disclosures from Cursor and security researchers regarding the cleanup process for affected developer machines. Observers will also be watching for any additional technical audits or changes to verification procedures on the Cursor marketplace. Coverage does not currently specify whether similar compromises have been identified on other platforms or what remediation steps are being enforced for the estimated five thousand users who downloaded the tampered extension version 2.1.313.