AgentDAST / Security Brief

Malicious Claude Code extensions in Cursor: check your developer machines

First reported Oct 29, 2026

Cursor disclosed malicious builds of the Anthropic.claude-code extension in its marketplace. Its updated notice identifies versions 2.1.312 and 2.1.313 and describes attempted SSH persistence. The malicious builds were not developed by Anthropic. Socket's investigation also distinguishes Cursor's marketplace from unsubstantiated claims about distribution through npm or Open VSX.

Who should check

macOS and Windows users who installed or updated those versions through Cursor's marketplace between 2:27 a.m. and 1:35 p.m. Pacific time on October 29, 2026. Version number alone does not establish that a machine received a malicious package; compare the vendor's package hashes and installation records.

What to do now

1. Check extension installation history and the indicators in Cursor's updated security notice.
2. Isolate machines showing evidence of execution. Follow the vendor's removal and recovery guidance; uninstalling the extension alone may leave persistence behind.
3. Rotate credentials accessible from affected machines using a trusted system, and assess whether the host needs rebuilding.

What this means for your website

A compromised developer workstation can put deployment credentials at risk. Reviewing extensions and endpoint evidence complements testing your deployed website; an HTTP assessment cannot establish that a developer machine is clean.

Sources and updates

• Cursor: security notice and updated affected versions ↗
• Socket Research: distribution evidence ↗

This brief reflects the sources checked on Nov 3, 2026. Follow the linked vendor notices for subsequent corrections and updates.

Keep reading

• Tailscale SSH and Serve: update the systems behind your website
• Searchjacked: browser extensions can expose your team's searches