The SpaceX-owned AI coding tool says the modified version of Claude Code appeared on its extension marketplace from 5:27AM ET and 4:35PM ET on Thursday. The extension contains malicious code that collects various information, including hostname, username, operating system, home directory path, public IP address, and more. Cursor has since removed the malicious extension from its marketplace and verified that “no other extensions were tampered with.” [Link: Cursor says up to 5,000 users affected by tampered Claude Code extension | https://www.reuters.com/business/media-telecom/cursor-says-up-5000-users-affected-by-tampered-claude-code-extension-2026-10-30/ | Reuters]
The SpaceX-owned AI coding tool says the modified version of Claude Code appeared on its extension marketplace from 5:27AM ET and 4:35PM ET on Thursday. The extension contains malicious code that collects various information, including hostname, username, operating system, home directory path, public IP address, and more.
Cursor has since removed the malicious extension from its marketplace and verified that “no other extensions were tampered with.”
This is the title for the native ad
Compare how 1 other independent news outlet reported on this story.
Do not ask again" prompt leads to passwords, API keys, and more being shared.
