30 October 2026
Tampered Claude Code extension spread via Cursor marketplace for 11 hours
First reported
Ars Technica, Fast Company and 2 others ran this on , a day before the next source picked it up.
- A fake version of Anthropic's Claude Code extension, sold through the Cursor code editor's marketplace, was available for about eleven hours on 29 October.
- Up to 5,000 developers could have installed it, and it tried to plant a secret remote-access key on their computers.
- The fake extension also collected details about each machine and user, such as hostname, username and public IP address.
Our read
Only Latent Space among the 30 newsletters we track covered this story, though it was first reported by Ars Technica, Fast Company, Latent Space and The Decoder. It is the second Claude Code story in our archive, following the 2026-10-17 piece on code review focus and the 2026-10-16 report on Torvalds using Claude Code for a Linux kernel patch series.
Earlier on this story
Written by Newskeryx from which newsletters covered this story and from our own archive.
How it was covered
Latent Spaceswyx & Alessio
The reported extension compromise and the SSH backdoor risk
Reported by The Next Web, The Decoder, Ars Technica, Fast Company