Cursor’s extension warning now covers two Claude Code versions

Cursor has expanded its security notice to cover malicious Claude Code extension builds carrying both version numbers 2.1.312 and 2.1.313. That matters if an early report led you to check only the latter. The affected packages were distributed through Cursor’s extension marketplace on October 29; the company’s updated account identifies Windows and macOS builds and distinguishes them from Anthropic’s official distribution.

The immediate question is whether one of those modified packages executed on a developer’s machine. Removing the extension alone does not answer it: the payload attempted to establish access that could survive outside the editor.

The distribution channel is part of the diagnosis

According to Cursor’s updated incident notice, the malicious packages were available from approximately 09:27 to 20:35 UTC on October 29. Cursor removed them, temporarily disabled the marketplace, rotated credentials and rebuilt the affected infrastructure. It says its audit has not identified other affected extensions.

Those are bounded findings, rather than a reason to treat every Claude Code installation as compromised. A familiar extension name and a version number are incomplete evidence when an attacker has modified the delivered package. The marketplace it came from, its contents and evidence of execution all matter. Cursor provides package indicators and checking guidance in the notice.

The distinction is familiar in software supply chains. Trusting the publisher of an extension and trusting the route by which its bytes arrive are related decisions, but a failure in one route does not automatically identify the publisher as the point of intrusion. Cursor has not supplied a complete public root-cause account.

What survived outside the editor

The payload collected machine and account metadata, added an attacker-controlled SSH key and attempted to arrange persistent remote access. Phorion’s technical analysis independently examines the injected code and its persistence mechanisms. SSH is a standard remote administration mechanism; an unauthorized key changes who might be able to use it. The persistence mechanisms described by Cursor included a macOS LaunchAgent and Windows scheduled-task or startup mechanisms.

There are important limits to the observed behavior. Cursor says attempts to enable SSH and establish access failed on ordinary hosts because of permissions and implementation errors. That does not cancel the other actions. Key insertion, persistence and outbound host metadata are separate findings, each requiring its own check.

The notice also distinguishes environment-variable names from their values in the collected metadata. That is not proof that every API secret stored in an environment variable was uploaded. Equally, a machine with unauthorized persistent access needs a broader assessment than the initial list of transmitted fields. Later activity cannot be ruled out merely by describing the first request.

Cleanup needs evidence, not just a newer version

For affected installations, Cursor links detection and remediation material and recommends reviewing endpoint and network records. Teams should preserve useful evidence, isolate machines where the malicious code executed, assess the persistence artifacts and consider whether rebuilding the host is appropriate. Credential and session rotation should happen from a trusted device.

These are different tasks from installing a clean extension. An update replaces application files; it does not necessarily remove an operating-system task or a key placed elsewhere. Likewise, the reported disabling of the attacker’s infrastructure reduces one avenue of communication without cleaning the endpoints that contacted it.

For organizations adopting coding assistants, the incident adds a concrete operational consideration to the editor and workflow choices around Cursor. The developer workstation can hold access to source code, build systems and deployment services. Extension distribution deserves the same attention as a build dependency, including an inventory of where packages came from and a way to identify their actual contents.

The useful dividing line now is not whether the editor opens normally. It is whether the delivered package and the machine it ran on have both been checked against the updated notice.