Summary
According to a post on X by @cursor_ai, Cursor says a modified Claude Code extension, version 2.1.313 and not built by Anthropic, sat in its extension marketplace for about 11 hours on Oct 29, from about 2:27 AM to 1:35 PM PT. The extension tried to plant an SSH backdoor with persistent remote access on macOS and Windows machines. Cursor says it took the marketplace down, neutralized the malware and asks users to update to 2.1.314. The source headline says the extension reached up to 5,000 users.
AI-assisted summary based on the listed source.
What happened
Cursor says a modified Claude Code extension, version 2.1.313 and not built by Anthropic, sat in its extension marketplace for about 11 hours on Oct 29 (about 2:27 AM to 1:35 PM PT) and tried to plant an SSH backdoor with persistent remote access on macOS and Windows machines. It took the marketplace down,...
Why it matters
Developers who use Cursor on macOS or Windows and may have installed the modified extension are the most directly affected, because the backdoor was meant to give persistent remote access. The post also asks affected users to check a file under ~/.ssh/, but the snippet cuts off before the details. Watch for Cursor's full incident details and any confirmation of how many users were affected.
Signal Intelligence
Signal Strength 90%
Technical label WATCH
Public Interest 52
Category BIG MOVE
Reader Depth PRACTICAL
Signal Strength reflects source quality, relevance, freshness and evidence. Public Interest helps organize discovery; it is not proof of truth.
Public Interest components
Recognizable Entity Score 90
Practical Impact Score 20
Novelty Interest Score 70
Consequence Score 34
Curiosity Score 0
Shareability Score 65
Why this is here
VQV surfaced this signal because it is recent, relevant to Consumer AI, connected to Scobleizer News Pulse (X).
