Cursor Expands Claude Code Malware Warning to Two Versions

Cursor expanded its warning to two malicious Claude Code extension releases for macOS and Windows, urging users who installed or updated them to clean affected machines and rotate credentials and sessions from a trusted system.

The releases were available for about 5:27 a.m. to 4:35 p.m. ET (9:27 a.m. to 8:35 p.m. UTC) on Oct. 29. Anthropic did not develop either release. The revised notice adds version 2.1.312 to the warning about version 2.1.313.

Code in the extensions could run as soon as they loaded, before normal activation and without a Claude Code session being open. It attempted to add an attacker-controlled Secure Shell (SSH) key and set up a reverse tunnel from the affected computer to a remote server.

The code also attempted to persist through system startup features. On macOS, it tried to use a LaunchAgent; on Windows, it attempted to create a scheduled task, with a Startup-folder fallback.

The initial collection included host details and the names of up to 40 matching environment variables, but not their contents. Cursor warned that this limited collection did not rule out later credential access through the backdoor.

Cursor cautioned that removing the extension alone may leave components running. “Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” the company said.

Cursor's guidance calls for reviewing endpoint, network and extension-installation records, isolating machines that show signs of execution, and removing unauthorized SSH keys, persistence files and active tunnels. It also advises assessing whether affected computers should be rebuilt and rotating credentials and sessions accessible from them, using a trusted system.

The SSH step was expected to fail on most macOS and Windows machines without administrator privileges. Even if the tunnel failed, an SSH key or persistence files could remain on the computer.

Cursor removed the releases, took the attacker's server offline, rotated its keys, rebuilt the marketplace and restored it. Neither Microsoft's Visual Studio Marketplace nor Anthropic's npm package carried the malicious releases. Anthropic confirmed its systems were not compromised.