Cursor reports that a maliciously modified Claude Code extension, version 2.1.313, was distributed through its extension marketplace on October 29. Cursor says at most 5,000 users were affected; the build collected host information and attempted persistent remote access, with success constrained by host privileges and code errors.
Why it matters
It documents a compromise of a coding assistant distribution channel, distinct from a prompt-injection demonstration.
Key facts
As stated in the sources, with where to find them.
- Cursor places distribution between about 02:27 and 13:35 Pacific time on October 29 and says the malicious build was not developed by Anthropic. The affected-user ceiling does not establish successful remote access on every host.What happened
- Cursor reports removing the build, auditing other extensions, rotating keys, rebuilding the marketplace and taking the attacker server offline with its provider.What we did
- Cursor says the remote-access step fails on hosts where the extension lacks the required administrator privileges, while host reporting and persistence still warrant remediation. It reports no evidence affecting other versions or the official distribution.What happened; What you should do
Findings that cite this record
Key questions this bears on
- Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.
- How are attackers using AI agents in real operations?To run parts of intrusions at scale: vendors report a state-aligned actor and criminal groups using open-source agent frameworks and commercial models.
Sources
Related records
Oct 21, 2026
Oct 26, 2026
Oct 15, 2026
Sep 22, 2026
Sep 9, 2026
Oct 29, 2026