Malicious Claude Code Extension in Cursor Marketplace Steals Data
A tampered Claude Code extension appeared in the Cursor marketplace for ~11 hours, attempting to steal user data and establish remote access. Approximately 5,000 users were affected before the extension was removed and the marketplace secured.
Full Report
Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft
[Matthias Bastian](https://the-decoder.com/author/matthias-bastian/) [View the LinkedIn Profile of Matthias Bastian](https://www.linkedin.com/in/matthias-bastian-128b71b1/) Oct 30, 2026 Heads up if you recently installed the Claude Code extension for Cursor. A tampered version was available in the Cursor VS Code extension marketplace on Thursday for about eleven hours, affecting up to 5,000 users, according to the company. Anthropic had no involvement in developing it.
The extension tried to harvest user data like hostname, username, operating system, and public IP address. It also attempted to set up remote access for the attacker, though that likely wouldn't have worked on most machines since it requires admin privileges, Cursor says. Once discovered, Cursor pulled the extension and took the entire marketplace offline. After working with providers to neutralize the malware and confirming there was no further risk, the marketplace was reinstated. Cursor says no other extensions were affected.
Cursor AdAd