Cursor removes tampered Claude Code extension after up to 5,000 users may have been exposed

Cursor said a modified Claude Code extension was available through its VS Code marketplace for part of Thursday and may have affected up to 5,000 users. The company removed it, blocked further distribution and temporarily shut down the marketplace before rebuilding it and restoring service. (4310613a-8d60-49f0-8b1f-71f28098642e)

• Cursor said the extension was not developed by Anthropic and was listed on its marketplace from about 2:27 a.m. to 1:35 p.m. PT on Thursday. (4310613a-8d60-49f0-8b1f-71f28098642e)· 1 source
• The extension attempted to collect host and user details, including the public IP address, and to set up remote access; Cursor said a key step required administrator rights and would fail on most machines. (4310613a-8d60-49f0-8b1f-71f28098642e)· 1 source
• Cursor removed the version, blocked its distribution, temporarily shut down and then rebuilt its marketplace, and said other marketplace extensions were not affected. (4310613a-8d60-49f0-8b1f-71f28098642e)· 1 source