Cursor AI reports security incident with tampered Claude Code VS Code extension affecting up to 5,000 users
Cursor AI has disclosed a significant security incident involving a modified version of the Claude Code VS Code extension. The company identified that a tampered version, specifically 2.1.313, was distributed through its marketplace, designed to install a persistent SSH backdoor on affected developer systems. This disclosure from Cursor AI serves as the primary source for the widely reported event. The incident is estimated to have impacted at most 5,000 users who downloaded the compromised extension, granting attackers persistent remote access to their systems. Following the discovery, Cursor reportedly shut down its extension marketplace to mitigate further risk. While the core facts are consistent across reports, details regarding the full extent of the compromise and specific attacker actions remain largely unverified beyond Cursor's initial statement.
15 articles from 15 outlets covered this story. No difference in framing or figures was found between them. The underlying claim is sourced from a press release.
What do all outlets agree on?
15 outlets covered “Cursor AI reports security incident with tampered Claude Code VS Code extension…”. All of them report the following:
- Cursor AI identified a security incident
- The incident involved a modified Claude Code VS Code extension
- The extension installed a persistent SSH backdoor
- Up to 5,000 users were affected
- The compromised version was 2.1.313
- Cursor shut down its extension marketplace
Did outlets disagree about this?
No. All 15 outlets covering “Cursor AI reports security incident with tampered Claude Code VS Code extension…” reported it the same way — no difference in framing or figures was found between them.
Which outlets covered this?
All 15 articles found on this story, grouped by the stance of the piece. Every link goes to the original publisher.