Hacking News
Cursor Warns of Malicious Claude Code Extension Update
Cursor, a code editor, has issued a security notice urging macOS and Windows users to clean their systems and rotate accessible credentials and sessions after uninstalling malicious Claude Code extension versions 2.1.312 and 2.1.313 from its marketplace. The company warns that removing the extension alone may leave persistent components running, and recommends trusted-system credential rotation for affected machines. The security issue was identified by Cursor and reported to them by security researcher Phorion, who found that the payload attempts to add an attacker-controlled SSH key, enable the machine's SSH remote-login service, and establish a reverse tunnel. The affected versions were initially identified by Phorion and reported by Cursor on October 30, 2026.