Cursor issued a notice after discovering malicious Claude Code extension artifacts distributed through an extension installation path. The incident includes at least two affected versions, 2.1.312 and 2.1.313, and platform-specific artifact hashes. Reported payload behavior included attempted SSH persistence and a reverse-tunnel sequence, some of which…
Inspect the ClaimsCase · DiggingBeagle record
Malicious Claude Code extension builds reached Cursor distribution channels
Cursor disclosed malicious VSIX artifacts in versions 2.1.312 and 2.1.313, with observed attempted persistence and remote access behavior.
Scope
Malicious Cursor/Claude Code VSIX builds 2.1.312 and 2.1.313 with corrected artifact hashes. No confirmed population-wide successful remote control is established.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Cursor documented malicious extension builds. Socket challenged an asserted OpenVSX publication event; the distribution record remains channel-specific. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-CURSOR-VSIX-REGISTRY-CHANNEL · CLM-C26-CURSOR-MALICIOUS-CLAUDE-VSIX-1 · Socket: Cursor distribution and absent Open VSX publication records · Cursor security notice on malicious Claude Code extension builds
At a glance
The observed malicious packages, possible installation count and successfully compromised hosts are distinct populations.
Read the implicationsWhich installed clients actually executed the malicious code is not fully known. Reported SSH actions did not establish a reliable reverse tunnel on every host.
Limits and uncertaintyFull account
Cursor issued a notice after discovering malicious Claude Code extension artifacts distributed through an extension installation path. The incident includes at least two affected versions, 2.1.312 and 2.1.313, and platform-specific artifact hashes. Reported payload behavior included attempted SSH persistence and a reverse-tunnel sequence, some of which failed rather than achieving a working session. The population estimate of up to five thousand users cannot be treated as the number of compromised machines.
Version and distribution-channel corrections matter: Socket subsequently challenged a claim that the malicious package was published through OpenVSX, so attribution to a distribution endpoint needs to follow the corrected vendor record. A legitimate extension name creates a trust cue, but installing it grants machine-level authority that the model cannot independently retract. Evidence should distinguish package download, extension execution, successful persistence and credential exfiltration.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 30, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-CURSOR-VSIX-REGISTRY-CHANNELSocket found no publication or removal event for Claude Code extension 2.1.313 in the reviewed Open VSX change feed and no matching npm publication entry; this weakens early claims about those channels without negating Cursor’s separate marketplace incident.supported
Basis: reported finding
- supportsSocket: Cursor distribution and absent Open VSX publication recordsindependent technical reproduction
Open VSX Has No Publication Record for 2.1.313; npm records also skip 2.1.313; Cursor Publishes Remediation Guidance
CLM-C26-CURSOR-MALICIOUS-CLAUDE-VSIX-1Cursor identified malicious Claude Code extension artifacts in two versioned builds and described attempted persistence; the reported reach must not be interpreted as confirmed compromised users.supported
Basis: reported finding
- supportsCursor security notice on malicious Claude Code extension buildsvendor statement
Cursor security notice, affected versions 2.1.312/2.1.313, artifact hashes, observed payload and remediation
Implications
The observed malicious packages, possible installation count and successfully compromised hosts are distinct populations.
Controls and mitigations
- Verify exact extension signer, release hash and distribution channel; remove suspect VSIX builds and inspect local persistence rather than assuming success.
Unknowns and contradictions
- Which installed clients actually executed the malicious code is not fully known.
- Reported SSH actions did not establish a reliable reverse tunnel on every host.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208