Cursor disclosed that versions 2.1.312 and 2.1.313 of a Claude Code extension in its VS Code extension marketplace, for macOS and Windows, weren't built by Anthropic and sent host details to an attacker for about 11 hours on October 29. In a related t...
VQV Signal
SECURITY
WATCH
PRACTICAL
Security: a tampered Claude Code extension sat in Cursor's marketplace for 11 hours
Cursor disclosed that versions 2.1.312 and 2.1.313 of a Claude Code extension in its VS Code extension marketplace, for macOS and Windows, weren't built by Anthropic and sent host details to an attacker for about 11 hours on October 29. In a related t...
Cursor disclosed that versions 2.1.312 and 2.1.313 of a Claude Code extension in its VS Code extension marketplace, for macOS and Windows, weren't built by Anthropic and sent host details to an attacker for about 11 hours on October 29. In a related thread, Gergely Orosz quoted a security engineer who doubts AI...
Security-conscious readers may want to review the source and watch for practical exposure or mitigation details.
VQV organizes public signals from inspectable sources. It does not independently verify the underlying report.
Signal Strength 87%
Technical label WATCH
Public Interest 51
Category SECURITY
Reader Depth PRACTICAL
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
Public Interest components
Recognizable Entity Score 82
Practical Impact Score 8
Novelty Interest Score 70
Consequence Score 62
Curiosity Score 0
Shareability Score 60
VQV surfaced this signal because it is recent, relevant to AI Coding Tools, connected to Scobleizer News Pulse (X).
No login, cookies, social SDKs, or automatic posting.