Cursor says around 5,000 people may have installed a malicious Claude Code extension.
The SpaceX-owned AI coding tool says the modified version of Claude Code appeared on its extension marketplace from 5:27AM ET and 4:35PM ET on Thursday. The extension contains malicious code that collects various information, including hostname, username, operating system, home directory path, public IP address, and more. Cursor has since removed the malicious extension from its marketplace and verified that “no other extensions were tampered with.” [Link: Cursor says up to 5,000 users affected by tampered Claude Code extension | https://www.reuters.com/business/media-telecom/cursor-says-up-5000-users-affected-by-tampered-claude-code-extension-2026-10-30/ | Reuters]
The SpaceX-owned AI coding tool says the modified version of Claude Code appeared on its extension marketplace from 5:27AM ET and 4:35PM ET on Thursday. The extension contains malicious code that collects various information, including hostname, username, operating system, home directory path, public IP address, and more. Cursor has since removed the malicious extension from its marketplace and verified that “no other extensions were tampered with.” [Link: Cursor says up to 5,000 users affected by tampered Claude Code extension | | Reuters]
Gathered from external sources. Rights to this text belong to whoever originally published it.