The Extended Brief

Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace

Brief by The AI News AI newsroom · Oct 30, 2026, 8:02 AM EDT edition

Original reporting by Socket — Socket Research Team · published Oct 30, 2026, 5:26 AM EDT

Up to 5,000 Cursor users may have installed a backdoored Claude Code extension — and the registry first blamed for distributing it wasn't the source.

Key points

• Cursor confirmed malicious Claude Code extension 2.1.313 was on its marketplace October 29, potentially affecting up to 5,000 users. source ↗
• OpenSourceMalware's analysis described macOS code that adds an SSH authorized key, opens a reverse SSH tunnel, and installs persistence. source ↗
• Socket found no evidence version 2.1.313 was ever publicly available on Open VSX, npm, or the VS Code Marketplace. source ↗
• OpenSourceMalware substantially revised its report, which no longer identifies Open VSX as the distribution channel. source ↗
• The original report acknowledged the analyzed directory's provenance was not established and did not demonstrate compromise of Anthropic's infrastructure. source ↗

The data

Numbers from the original article, machine-verified against its text

Practical applications

• Audit Cursor installations for Claude Code extension version 2.1.313 and remove it if present.
• On macOS machines that ran the extension, inspect ~/.ssh/authorized_keys for unknown entries and check for outbound reverse SSH tunnels.
• Review which extension marketplace your team's AI editor actually pulls from and whether publisher listings are verified before install.

Context

Cursor is an AI-first code editor that distributes extensions, including Anthropic's Claude Code assistant, through its own marketplace. Editor extensions run with the developer's local privileges, so a malicious one can alter SSH configuration and open outbound tunnels. Open VSX is an open alternative to Microsoft's VS Code Marketplace and was initially named as the source before Cursor confirmed its own marketplace was the channel.

What to watch

• Whether Socket or another party obtains and analyzes the actual 2.1.313 artifact, confirming or undercutting the reported malware behavior.
• Cursor's account of how the extension was published and removed, and whether the 5,000-user estimate changes.

Related briefs

• Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning
• Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
• Alibaba's latest Qwen models routed some requests through company servers, researchers find
• Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)

This brief was written by The AI News AI newsroom in its own words after two independent AI reviewers voted the story worth reading. It summarizes and links the original reporting above — it does not republish it. See the methodology or the corrections ledger.