Malicious Claude Code extension: what UK businesses need to check

What happened?

On 29 October 2026, Cursor reported that malicious copies of the Claude Code extension had been distributed through its extension marketplace for part of the day. The affected versions were 2.1.312 and 2.1.313, under the identifier anthropic.claude-code.

Microsoft says these malicious packages were not distributed through Microsoft Visual Studio Marketplace or the npm package @anthropic-ai/claude-code. Anthropic also confirmed that its systems had not been compromised and that it had not produced the malicious package. The available evidence points to an incident confined to Cursor’s marketplace.

This was an attempted supply-chain attack: attackers tampered with software that users might install or receive through an automatic update, rather than approaching each victim directly.

What did the malicious extension try to do?

Microsoft found additional JavaScript that ran before the extension’s normal functions. It attempted to prepare remote access using Secure Shell, or SSH, a tool commonly used to connect securely to computers.

The code tried to add an attacker-controlled access key, switch on the computer’s SSH service and create an outbound connection that could provide a route back into the device. It also wrote scripts and startup settings intended to restart that connection after a login or reboot.

Meanwhile, the extension could continue working normally, giving users little reason to suspect a problem. The code also collected computer and user details and attempted to send them out. It gathered names of selected environment variables associated with credentials, but Microsoft’s analysis does not demonstrate that it stole the secret values stored in those variables.

Why this matters to a small business

The immediate question is whether anyone in your business installed or automatically updated to either affected version through Cursor. The marketplace source matters: this report does not establish that every Claude Code installation was affected.

Successful remote access was not guaranteed. It depended on permissions and SSH settings on both the workstation and the attacker’s server. Cursor reported that errors and administrator-permission requirements prevented SSH access on most macOS and Windows devices.

However, a failed connection does not necessarily mean a clean computer. Access keys and startup files could still have been written. Crucially, these components sat outside the extension’s installation folder, so removing or updating the extension alone would not clear them. Cursor’s reported takedown of the attacker’s server would not remove those local files either.

What to do next

Ask your IT team or managed IT provider to check extension installation records for the affected versions and their marketplace source. Where there is evidence that the malicious code ran or installed remote-access components, isolate the device and preserve evidence before cleaning it up.

Have a qualified technician examine SSH access keys, connection activity, generated scripts and startup settings against the published indicators. They should remove confirmed malicious components and the tampered extension while preserving legitimate remote-access settings. Familiar-looking names such as SysMon are not enough on their own to prove that an item is malicious.

Cursor has published platform-specific checks and remediation scripts. Your IT provider should review their requirements before using them, then verify the results rather than assuming the script has resolved everything.

Finally, investigate activity during the exposure period. Reset credentials and revoke sessions from a known-clean device if evidence indicates credential access or trust in the affected device cannot be restored. Rebuild it where the investigation requires this, and check that malicious components do not return after restarting.