Developers using Cursor faced a possible security risk after a Claude Code add-on sought device details and remote access; Cursor estimated up to 5,000 users may have been affected, Reuters reported.
Cursor said the extension was listed from 5:27 a.m. to 4:35 p.m. ET on Oct. 29, a span of about 11 hours, Reuters reported. The estimate was not a confirmed count of people who installed or ran the add-on.
The extension was not made by Anthropic, Cursor said. It tried to gather hostnames, usernames, operating systems and public IP addresses, and to give an attacker a way to connect remotely, Reuters reported. Cursor said a step required for remote access needed administrator privileges and would fail on most machines.
Cursor said it removed the listing, blocked further distribution and temporarily took its marketplace offline. It later rebuilt and restored the service, and said other extensions were unaffected, Reuters reported.
Cursor's current extension guide describes third-party add-ons sourced through Open VSX and checks run through the company's marketplace service. It warns that an extension with the same identifier in Open VSX and Microsoft's marketplace may have a different publisher or code. The guide does not say which safeguards applied to the Oct. 29 listing.
In a separate 2025 investigation, Kaspersky said it traced a cryptocurrency loss of about US$500,000 at one company to a malicious Open VSX extension named Solidity Language. Kaspersky did not link that case to the Oct. 29 Claude Code extension incident.
