# Cursor discloses malicious Claude Code extension in its marketplace

_Published Friday, October 30, 2026 at 8:15 AM EDT · Security · Latest · Tier 2 — Notable_

![Cursor discloses malicious Claude Code extension in its marketplace — Primary](https://www.thenews.com.pk/assets/uploads/2026-10-30/1421855_024834_updates.jpg)

Cursor disclosed Friday that a counterfeit Claude Code extension remained in its marketplace for about 11 hours on Thursday, potentially reaching up to 5,000 users. The extension was modified with malicious code and was not built by Anthropic.

The extension targeted computer hostnames, usernames, operating systems and public IP addresses, and attempted to enable remote control. Cursor said one step required administrator permissions and would fail on most computers. The company shut down the marketplace, rebuilt it and restored service, saying no other extension was affected.

## Sources

- [The News International](https://www.thenews.com.pk/latest/1421855-malicious-claude-code-extension-hit-cursor-5000-at-risk)

---
Canonical: https://techandbusiness.org/newswire/ikqJOv3bBggWpU84_V_qwt
Published: 2026-10-30T12:15:53.265Z
Story chronology: 2026-10-30T09:46:41.000Z
Retrieved: 2026-10-30T14:39:17.224Z
Publisher: Tech & Business (techandbusiness.org)