Cursor says it identified a malicious modified version of the Claude Code VS Code extension distributed through its IDE extension marketplace, affecting at most 5,000 users. The company stated the malicious extension was not developed by Anthropic and does not affect other extensions or its other products. Cursor took the marketplace offline, neutralized the malware with relevant providers, and reinstated it after confirming no further risk. Affected customers are directed to a blog post with mitigation instructions, and all customers are asked to update to Claude Code for VS Code version 2.1.314.

AI summary of the linked source — not editorial content.

Story signal · how it spread on X · via Elfa

as of

Claude · a product of Anthropic · source

Spread
i
Distinct X and Telegram accounts Elfa counted behind this story’s reports, summed over the thread. Not posts, not impressions.
18 accounts

first post
Leviathan +5 h later

ANTHROPIC reaction
i
Price change from the first post to 24 hours later (Hyperliquid). BTC over the same window is shown so a market-wide move is not mistaken for a reaction to this story. Not advice.
−1.0% 24h after post

$1,794 → $1,776
BTC −0.3% same window

Thread · 1 event
  1. First reportCompromised Claude Code extension reportedly exposed users to an SSH backdoor18 acc.
  2. Leviathan published this article

All times UTC.

Cited posts

  • @mattjay Matt JohansenFirst reportOn X ↗

    The official Claude code VS Code extension was compromised and pulling it would’ve installed an ssh backdoor on your machine for a brief window today.https://t.co/NHuloOo4t4

  • @AGTPinsights AGTPOn X ↗

    Anthropic's official Claude Code VS Code extension was compromised today. Here's what you need to know. Matt Johansen posted that the official extension was hit, and that pulling it would have installed an SSH backdoor on your machine for a brief window today. His post has about… https://t.co/UaHk9Qz0RQ

  • @TheHackersNews The Hacker NewsOn X ↗

    🚨 Official Claude Code VS Code extension compromised in a supply chain attack. Attackers injected a malicious loader into v2.1.313 to install a persistent SSH backdoor, add their SSH key, and send host data. Up to 5,000 users installed the malicious version. Read:…

Show 3 more cited posts
  • @TimJayas Tim JayasOn X ↗

    🚨 official Claude Code VS code extension is compromised if you're on a VS code fork that pulls from Cursor, Windsurf, VSCodium and have updated to version 2.1.313 you much be cautious here's how you can check: run this on your terminal code --list-extensions --show-versions…

  • @cursor_ai CursorOn X ↗

    We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions…

  • @cyb3rops Florian Roth ⚡️On X ↗

    Cursor users: check your Claude Code extension. Cursor confirms a trojanized Anthropic.claude-code v2.1.313 in its extension marketplace on 29 October, 09:27 to 20:35 UTC. It estimates up to 5,000 affected users and identifies macOS ARM64 and Windows x64 builds. Loading the…

12 more accounts posted about this · 1 Telegram channel (no public link)

TradersTrader calls tracked by Elfa · not advice

Whole crypto market, not this story

Crowding0th percentile · vs last 28 days, 50 typical
Pulse 24h99/100 · unusualness of new calls, 0–100, 50 typical, higher means more long than usual
Book97.0% long · 10,758 accounts

As of 30 Oct 09:10 UTC.

Social-monitoring data, not investment advice Elfa prices Hyperliquid post text from Xas of

Explore the topic

Loading related coverage…

Explore the full feed

Comments

Loading comments…