# Cursor says up to 5,000 users affected by tampered Claude Code extension

> **Open Intelligence Dossier** · First detected: 2026-10-30 14:00 UTC · Category: Technology

## Executive Summary
Cursor reveals up to 5,000 users were impacted by a trojanized Claude Code extension carrying a persistent SSH backdoor.

## Intelligence Brief
Recent coverage from outlets including Reuters, The Hacker News, Help Net Security, Inshorts, Rescana, and Step Security details a security incident involving a tampered software extension. Specifically, the official Claude Code extension on the Cursor marketplace was compromised with a Trojan horse package identified as version 2.1.313. According to reports, this malicious update planted a persistent Secure Shell backdoor directly onto developer machines. Coverage indicates that the fraudulent extension remained live and accessible to users for a total duration of eleven hours before being addressed. Reporting across these various publications heavily emphasizes the mechanics of the breach and the rapid response from platform monitors.


Inshorts notes that Cursor detected the fake artificial intelligence extension opening a secret door for malicious actors. Meanwhile, technical analyses from Step Security, Rescana, and Help Net Security break down how the poisoned extension functioned to compromise developer environments. Reuters anchors the broader impact by citing statements from Cursor regarding the scale of the exposure, confirming that as many as five thousand individual users may have been affected by the tampered installation during its operational window. This incident sits within the broader context of software supply chain vulnerabilities targeting developer marketplaces and integrated development environments. The deployment of a backdoor through a trusted extension channel highlights ongoing risks associated with third-party software components used in software engineering workflows.


Coverage does not yet specify the exact initial vector used by the attackers to compromise the extension listing, nor does it detail the full extent of unauthorized access obtained on the affected machines beyond the establishment of the persistent SSH backdoor. Future updates will likely track further disclosures from Cursor and security researchers regarding the cleanup process for affected developer machines. Observers will also be watching for any additional technical audits or changes to verification procedures on the Cursor marketplace. Coverage does not currently specify whether similar compromises have been identified on other platforms or what remediation steps are being enforced for the estimated five thousand users who downloaded the tampered extension version 2.1.313.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| DoublePulsar | Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide | [Source Link](https://news.google.com/rss/articles/CBMiwgFBVV95cUxOYlhhemJJUy1zRzV1V3BYQnZVOEsxR3JDbzF5eUVTNzg3Q180OWxaTFV5alZVNUpHWGdvVWVabEE5OTVmV1dyTjJSTnI1cGctc2VCcldCYzRaMFhfMlpWSE1fTzN5WXh6STNaNDl0TXV1RS1KaW9LTDJaenNfSHo1WG1TLUY4WEJDUmhMRE5OTUR6Z2QwTmMtZTBvYkJHZkpkakRHQThIamxlcDRWQ0U1R3l3TnNvYlJlaktTeWRHVXYwUQ?oc=5) |
| Help Net Security | Claude Code extension poisoned with persistent SSH backdoor | [Source Link](https://news.google.com/rss/articles/CBMihAFBVV95cUxOVnQ4Ylo3R2N1ekJRbGFaYko3RF9FN2hsdzlncVA1U1Y1TWxLcTdnUEhyR3NYMmtYaUJYRXBsSlQ0bzZKX3ZVTEdkaFc0eWZYbVFLVXZVbnNxcHROU3NHQkhGQWRHNGc0MnNNaXo5VnktTEZILU9PUTltS0liN2lVUUdaWEU?oc=5) |
| Inshorts | Cursor catches fake Claude AI opening secret door for hackers - The fake extension was live for 11 hours - Inshorts | [Source Link](https://news.google.com/rss/articles/CBMipwFBVV95cUxPaUVrYjJXZVdDM0hsaWlWSUc0VlNFUFY5N0xQRzluY2lQcXJFa0dBazFoSlV5Vk1qYmZ4bjRSYVdnUGhhSkVGS3I1blRWckxpd2l3MVNBcU5VT05MSm1QODcySU1IdlVCa2FaSml3NVQ2UVE3THJpXzZ2M0Rqb1JZYzFZNFoxVkI0TGh3elZpSVpULUtvbi1SZG16WG5qTHZyNy1sYXJXa9IBrAFBVV95cUxQUkRFcjdMZDdPM0RrUUt4YlVWeGRqcmladXl4a256UWJkWHlTQ0dRUEh0RjZkeXF1Vzd2aGxNeUZ5NUU1X3VnenpIVmlYZktXbHBJM1VhUVlVYjMxQ050TlBfb05PeTRKYTZLZFhoMFdMTmkzRGZwbXZhanhlZS1ldGVHeTRtNENVb3RQY2dqZ3VSUVI0NWNXQjRhTWNxWjBYcUJROTB2T2ltcHV) |
| Rescana | Trojanized Claude Code Extension 2.1.313 in Cursor Marketplace Plants SSH Backdoor | [Source Link](https://news.google.com/rss/articles/CBMiowFBVV95cUxNdDNoVkx3Mmpqa0JHVUJkdjl6RTEyX1RpU0p2eHF3eGxWNm52aEd1NDUxY3ZZLU12QTk0WC1OZkNCR2J6azRkTEd6QVliX1B0V0NzT21RRWRYUTBwQngyNFR4dFNrMmxyeGhwSzE1a1VJdWZ4X0hkcWxlWHgtWFVJcGRSSjczWm04RXJCVHJ5ZGkzQlRmTHJYbVhFQ3FyS0ViLTEw?oc=5) |
| Step Security | Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines | [Source Link](https://news.google.com/rss/articles/CBMic0FVX3lxTE5QN1Q5bXI1WXMzZlpOLWIxaDJEVGhuTWZxcXRwTWdaXzlETHZYd0pIcGhpdnR3R1dsQXUzWGFoZHUyZUd2UldGMHotYVFHNHFQZjdCWERJektwVXZVMWw5dGc4WldHQktiLXFYVnBST19Ecmc?oc=5) |
| The Hacker News | Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor | [Source Link](https://news.google.com/rss/articles/CBMigwFBVV95cUxPS2hyRVBYNEpLVEQ2V2IwYk9aZmhtUm9veEV5RE4tZVVONXpIM1Y5Q1hxSWprYjFDR1NXNGF2MjlyeUpod2p6NFNydVltcmpudHoxU2wtUWJxSUdrWUhhanRiTUo3ZzdGNXViN0NyRUdTcHFiVEJfT2Z0VklGczNiOGhzYw?oc=5) |
| Reuters | Cursor says up to 5,000 users affected by tampered Claude Code extension | [Source Link](https://news.google.com/rss/articles/CBMixgFBVV95cUxOSE5Sd2ZzblVoTHk3cWowdjBHOUlGQ25obHhuSkoyell3S2JWTUxqeXFFRnBMbTVaOENobjFKVFJXT0VhQi1VSzVBX0dSM3N5SGJ4N2VWSjhnX3NCQlJsSmdTX1RmSlpEeHN0NFFXVll0MzZRV1lfbUpkcDZ1dk9xQXpSWHBVUVJiMDJCYXgtMmlxMnQ1a2dxcmxBZlFBcTY0SUZMYXZyeHNZX3o1ejRUbkxmN3JqRlYtSnNCRnFiZkswLWx4S2c?oc=5) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-10-30/cursor-says-up-to-5-000-users-affected-by-tampered-claude-code-extension*