# Cursor Removes Claude Code Extension After Warning of SSH Backdoor

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/44546
Published: 2026-10-30T10:37:52.000Z
Updated: 2026-10-30T10:37:52.000Z
Section: Technology

> Cursor said the extension may have affected up to 5,000 users and urged an update to version 2.1.314.

Cursor removed a Claude Code extension from its marketplace after warning that version 2.1.313 collected host information and attempted to install an SSH backdoor, potentially affecting as many as 5,000 users.

The flagged item was a Claude Code extension for Visual Studio Code carrying version number 2.1.313. Cursor said Anthropic did not develop that release. Its security notice warned of host information collection and an attempted SSH backdoor installation, naming those behaviors as risks to users.

Cursor urged users to update the extension to version 2.1.314 after taking the listing down. The company estimated that as many as 5,000 users may have been exposed to the extension’s activity. Its warning concerned a specific marketplace release, version 2.1.313, while 2.1.314 was the version Cursor recommended.

The distinction between the two versions is central to Cursor’s notice: it identified 2.1.313 as the malicious listing and directed users to version 2.1.314. The incident involves a Visual Studio Code extension distributed through Cursor’s marketplace, and Cursor said Anthropic did not develop the flagged release.