Cursor removes malicious extension posing as Claude Code

A malicious extension presented as Claude Code was available in Cursor’s VS Code extension marketplace for about eleven hours on Thursday, potentially affecting up to 5,000 users, according to the-decoder.com, citing Cursor. Anthropic had no involvement in developing the extension.

The extension attempted to collect hostnames, usernames, operating-system information and public IP addresses. It also tried to establish remote access. Cursor said that second attempt probably would not have succeeded on most machines because it required administrator privileges. The report does not establish which attempts succeeded.

Cursor removed the extension and temporarily shut down the entire marketplace. According to the company, it restored the marketplace after working with providers to neutralize the malware and confirming there was no further risk. Cursor said no other extensions were affected.

For developers and security teams, the useful distinction is between the extension’s two attack paths. Cursor’s administrator-privilege explanation concerns remote access. It does not establish that the separate attempt to collect identifying information failed. Analysis of a potentially exposed machine should therefore keep those outcomes separate: “remote access unlikely” is insufficient grounds to conclude “no information collected.”

That distinction gives teams a concrete way to prioritize review. First establish whether the affected extension was installed during the reported availability window. For machines where it was, record whether it could have obtained the administrator privileges Cursor says remote access required. Machines where those privileges were available warrant priority investigation of the remote-access attempt. Machines without them still warrant assessment of the attempted information collection. The report supplies neither an exact extension identifier nor precise installation-window timestamps, so a Claude Code label alone cannot resolve exposure.

The marketplace’s restoration and an individual machine’s exposure also answer different questions. Cursor’s response addresses the distribution channel and malware neutralization. For an internal incident record, teams should separately document the installation evidence, privilege conditions and any evidence of collection or remote access. Where evidence is unavailable, record the outcome as unknown rather than treating marketplace availability as proof of what happened earlier.