Malicious Claude Code extension in Cursor marketplace steals data
What happened
On 31 October 2026, The Decoder reported that a tampered Claude Code extension was listed in Cursor's VS Code extension marketplace on Thursday and was dealt with about eleven hours later, affecting up to 5,000 users. The report said the extension attempted to steal data and establish remote access, and that Anthropic was not involved in its development. Cursor confirmed the listing duration and the scope of impact. Developments so far centre on the extension's removal and impact assessment, with no further details on follow-up measures disclosed.
Written by AI from the reports · updated 3 h ago
Timeline
Follow the reports to see the event from each side.
- The DecoderMalicious Claude Code extension in Cursor's marketplace attempted remote access and data theft
A tampered Claude Code extension was live on the Cursor marketplace for about 11 hours, affecting up to 5,000 users. It tried to steal user data and set up remote access. Cursor took the entire marketplace offline and reinstated it after confirming there was no further risk.
Heat of this event
Current heat 9·Peak in the comparable range 10（Oct 31 03:00）·Change over 24 hours in the comparable range –
The trend compares only the same accounts observed without a break, so its range can be narrower than the current heat count. Move the pointer or tap the chart to see each hour; with a keyboard, use the left and right arrow keys.