Cursor extension notice: a clear next step for affected builders

Start with the version and the store

If you used the Claude Code add-on in Cursor this week, a specific installation check is worth doing. Find out which version was installed and where it came from. Share those details with the person responsible for your device before deciding what recovery is needed.

Cursor reported on October 29 that tampered copies of anthropic.claude-code versions 2.1.312 and 2.1.313 were distributed through its extension marketplace for macOS and Windows. The stated window was about 2:27 a.m. to 1:35 p.m. Pacific Daylight Time that day.

An extension is an add-on that gives an app extra features. In this case, the affected copies carried Claude Code branding but were not developed by Anthropic. Cursor says it removed them and rebuilt its marketplace.

Read the announcement: Cursor: Security notice for malicious Claude Code extension versions.

Understand what the reports establish

Microsoft published a separate analysis on October 30. It confirmed that the affected packages were not distributed through the Microsoft Visual Studio Marketplace or the official Claude Code command-line package. Anthropic told Microsoft its systems were not compromised.

The unwanted software attempted to leave behind a way to access the device remotely. Whether that access succeeded depended on the device and its settings. Background startup changes could still be left behind even when an access attempt failed.

That distinction matters for recovery. A working app or an unsuccessful connection does not establish that the device has no remaining unwanted software. The reports describe a specific distribution incident, not evidence that every Claude Code installation was affected.

Get the affected device checked properly

If your installation may match, preserve the installation details and ask qualified IT support to follow the linked Cursor and Microsoft guidance. Their instructions cover investigation, isolation when needed, removal of unwanted changes and checking whether the device should be rebuilt.

Cursor warns that uninstalling the extension alone may be insufficient because separate startup software can remain. Microsoft also cautions that failing to find one known sign of the attack does not establish that a device is clean.

Follow the official guidance and your IT assessment on which passwords, access keys and signed-in sessions to replace or revoke, including when trust in the device cannot be restored. Use a trusted device for those changes. Avoid experimenting with unfamiliar cleanup commands on a computer that may be affected.

Keep a simple record for your next build

Once immediate recovery is handled, a short record can make future checks easier. Keep the names, versions and download sources of the tools used to build your app, along with the person who manages updates.

For learners, this is a useful habit to practise on a separate project with invented information. Know what you installed and which account it can use. A familiar product name is one part of the record; the exact package and distribution source help support teams investigate a notice like this.

You can keep developing your skills while taking a reported incident seriously. The constructive next step is a focused check and appropriate support, with clear evidence before returning an affected device to trusted work.