Cursor AI Updates: October 31, 2026

1. Cursor Pulls Malicious Claude Code Extension Builds From Its Marketplace and Rebuilds It

Cursor published a security notice on October 29, updated October 30 with revised indicators of compromise, after malicious versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension for Windows and macOS were found in the Cursor VS Code Extension Marketplace; Cursor says the builds were not developed by Anthropic and that no other marketplace extension or the official distribution was affected. The builds were available from about 2:27 am to 1:35 pm PT on October 29. The payload reported hostname, username, OS, architecture, home directory, environment variable names, working directories, Git email and public IP to an attacker server, tried to add an attacker-controlled SSH key named svc-telemetry to authorized_keys, enable the local SSH service and open a reverse SSH tunnel, and installed persistence through a macOS LaunchAgent or a Windows scheduled task running as SYSTEM with a Startup-script fallback that retried the tunnel about every 60 seconds. Cursor says the tunnel step would generally fail without administrator rights, but the key, persistence and host details were still written or sent, so anyone who installed either version should remediate regardless. Cursor removed the version, blocked distribution, shut the marketplace down, took the attacker’s server offline with its hosting provider, rotated its keys, audited access and rebuilt the marketplace before bringing it back online. Affected users should check for the svc-telemetry key, run the remediate-macos.sh script as the affected user or remediate-windows.ps1 in an elevated PowerShell (both exit non-zero if anything remains), rotate credentials and sessions from a trusted system, and consider rebuilding the host, since uninstalling the extension is not enough; the notice does not say how the builds were published or how many users installed them. Source