Malicious Claude Code extension in Cursor marketplace steals data
What happened
On 31 October 2026, The Decoder reported that a tampered Claude Code extension was listed in Cursor's VS Code extension marketplace on Thursday and was dealt with about eleven hours later, affecting up to 5,000 users. The report said the extension attempted to steal data and establish remote access, and that Anthropic was not involved in its development. Cursor confirmed the listing duration and the scope of impact. Developments so far centre on the extension's removal and impact assessment, with no further details on follow-up measures disclosed.
Written by AI from the reports · updated 2 h ago
Timeline
Follow the reports to see the event from each side.
- The DecoderMalicious Claude Code extension in Cursor's marketplace attempted remote access and data theft
A tampered Claude Code extension was live on the Cursor marketplace for about 11 hours, affecting up to 5,000 users. It tried to steal user data and set up remote access. Cursor took the entire marketplace offline and reinstated it after confirming there was no further risk.
Heat of this event
Not enough continuous observations yet to draw a trend.