Hub/AI Security/Advisories/cursor-marketplace-claude-code-2026

Malicious 'Anthropic.claude-code' 2.1.312 / 2.1.313 in Cursor's extension marketplace

Cursor says two impersonating versions (Windows / macOS) attempted an SSH backdoor. Cursor removed them, shut down and rebuilt the marketplace, and rotated keys.

Published	Oct 29, 2026
Severity	Not Rated
CVE	None assigned
Status	resolved
Affected	Not listed
Fixed in	Not listed
Component	Cursor VS Code Extension Marketplace

Sources

https://cursor.com/blog/claude-code-extension-security-notice

Checked 2026-11-04. We copy severity and fix versions from the source and never estimate them.

Affected tools

Cursor Claude Code Security posture matrix

Weekly, free

What changed in AI integrations

One short email when MCP clients, plugin ecosystems, IDE integrations, AI plan prices or security advisories change. Every item is sourced.