PulseAugur
EN
LIVE 06:16:08

Malicious Claude Code extension in Cursor IDE exposed user data

By PulseAugur Editorial · [2 sources] ·

A malicious version of the Claude Code extension for the Cursor IDE was available for approximately 11 hours on October 29, 2026. The compromised extension attempted to steal user data and grant attackers SSH access to machines running Windows or macOS. Cursor has stated that Anthropic did not develop the malicious build, and the vulnerability stemmed from a compromised credential within Cursor's own systems, reportedly exposed by a third-party provider named Fireworks. AI

IMPACT Security vulnerabilities in AI-powered developer tools can undermine trust and slow adoption of integrated AI assistants.

RANK_REASON The cluster describes a security incident involving a third-party extension for an IDE, not a core AI model release or research.

Read on Medium — Claude tag →

AI-generated summary · Google Gemini · from 2 sources. How we write summaries →

Malicious Claude Code extension in Cursor IDE exposed user data

How we ranked this

Signal score
41 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
The cluster describes a security incident involving a third-party extension for an IDE, not a core AI model release or research.
Source corroboration
2 independent sources
Multiple independent publishers reporting the same story raises confidence that it's real and newsworthy.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
Breaking (< 6h)
Fresh story with cross-source coverage still developing. Ranking may shift as more sources report.

Full methodology in our editorial standards.

COVERAGE [2]

  1. dev.to — Claude Code tag TIER_1 English(EN) · devTalk ·

    Malicious Claude Code Extension in Cursor: Check Your Machine

    <p>If you use Cursor and had the Claude Code extension installed on 29 October 2026, there is a real chance you ran a backdoored copy of it. Headlines have described this as "Anthropic hacked", and that is not what the vendor reports say. This post separates what has been confirm…

  2. Medium — Claude tag TIER_1 English(EN) · Dev Talk ·

    Malicious Claude Code Extension in Cursor: Check Your Machine

    <div class="medium-feed-item"><p class="medium-feed-image"><a href="https://devtalk94.medium.com/malicious-claude-code-extension-in-cursor-check-your-machine-c98bdf624e3c?source=rss------claude-5"><img src="https://cdn-images-1.medium.com/max/1200/0*TJKFFaVKQB9NoFxp.jpg" width="1…

RELATED ENTITIES

RELATED TOPICS