Skip to content
Moojaz — موجز
Search
Menu
HomeRegionsMaghrebAfricaMiddle EastEuropeAsiaAmericasWorldSectionsPoliticsEconomySecurityHealthScienceTechnologyAIEnvironmentCultureSportsSearch
United States of America
File

Cursor: Claude Code extension security

This dossier tracks the compromise of Claude Code extensions distributed by Cursor and remediation measures.

Last updated : 1 key moments
cursor logo.
The Cursor logo, used to identify the company. — Cursor / Wikimedia Commons — CC BY-SA 2.5 https://creativecommons.org/licenses/by-sa/2.5/ ; sans modification.

Where things stand

As of 31 October 2026, the alert covers versions 2.1.312 and 2.1.313 for macOS and Windows; uninstalling alone may leave scripts active.

Reported information

Cursor security alert covers two Claude Code extension versions

Cursor’s notice checked on 31 October 2026 identifies Claude Code versions 2.1.312 and 2.1.313 for macOS and Windows distributed through its marketplace on 29 October. Phorion has updated its analysis to cover both versions.

cursor logo.
The Cursor logo, used to identify the company. — Cursor / Wikimedia Commons — CC BY-SA 2.5 https://creativecommons.org/licenses/by-sa/2.5/ ; sans modification.

Cursor says it removed the altered packages and had the attacker’s server taken offline. Phorion found that the code planted an SSH key and persistence mechanisms; uninstalling the extension may leave these behind.

The vendor asks users to check affected machines, isolate hosts showing execution traces, remove malicious access and scripts, and rotate credentials from a trusted device. Remote access depended in part on SSH being enabled; installation therefore does not establish that an attacker logged in.

Sources 2