Technology: tampered Claude Code extension reached 5,000 Cursor users and triggered a security alert

A tampered copy of the Claude Code extension reached up to 5,000 Cursor users through that platform's extension marketplace on Thursday, October 29, security researchers reported, in a supply-chain incident that puts programmers and companies using AI coding tools on alert.

StepSecurity's analysis, published October 30, says the tampered version 2.1.313 installed persistent remote-access mechanisms. According to the reports, the manipulated copy was live for about 11 hours and tried to add an attacker's SSH key, enable SSH access and send the names of up to 40 secret-like environment variables. Cursor said it reached at most 5,000 users on Windows and macOS.

Anthropic, the company behind Claude, clarified that its own systems and its official distribution channels were not compromised and that it did not build the tampered copy, according to company statements cited in Saturday's reports.

The recommendation for technical teams is to check whether any machine installed the affected version and to follow Cursor's incident guidance, rather than assuming that uninstalling the extension is enough. Specialists warn that, before deciding which credentials or systems need remediation, teams must establish which machines were exposed.

The case adds to a tense week in the technology sector: the Nasdaq index fell 2.9% on Friday, October 30, amid investor doubts about whether artificial intelligence spending is generating returns quickly enough, according to CNBC reports cited on Saturday.

Photo: Precise Impact AI

Source: Precise Impact AI