AI Coding Extension Security: What the Fake Claude Code Extension Means for Your Team

An AI coding extension is an add-on that runs inside a code editor such as Cursor or VS Code, and on October 29 a fake copy of Anthropic's Claude Code extension was served to Cursor users. If anyone who builds software for you uses Cursor, check two things this week: whether their machine was affected, and whether your team has rules about which AI coding extensions get installed.

What happened with the fake Claude Code extension?

According to Cursor's security notice, versions 2.1.312 and 2.1.313 for Windows and macOS were affected between about 2:27 a.m. and 1:35 p.m. Pacific time. Anthropic did not build them.

The malicious code collected details about the computer, such as the username and public IP address. It then tried to add an attacker's SSH key and open a hidden remote connection that restarts itself. Cursor says the step that turns on remote login needs administrator rights, so it would fail on most Mac and Windows machines. The attacker's server has since been taken offline.

Microsoft's analysis adds that the bad versions were never published on Microsoft's Visual Studio Marketplace or through Anthropic's official npm package, and Anthropic confirmed its own systems were not compromised. The code sent the names of environment variables, not their values.

Why does an AI coding extension carry so much risk?

Because an AI coding extension runs with the same access as the person using it. Microsoft notes that the injected code could change files and run system commands, while the extension kept working normally to avoid alerting the user.

That matters more for AI-built software than for most office tools. The laptop running the editor often holds the keys to everything, such as database passwords in a local settings file and the API keys for your cloud and payment accounts. A compromised AI coding extension doesn't need to break into your app. It only needs the developer's machine.

Cursor's own help page also warns that the same extension name can point to a different publisher or different code on Cursor's marketplace (which uses Open VSX) than on Microsoft's. A familiar name is not proof of a familiar publisher.

How do you check whether your team was affected?

Ask one question first: did anyone install or update Claude Code from Cursor's marketplace on a Mac or Windows machine on October 29? If the answer is no or "we don't use Cursor," you're done with this incident.

If the answer is yes or "not sure," have the developer run the short check in Cursor's notice. It looks for an SSH key labeled svc-telemetry. If the key is found:

1. Run Cursor's remediation script for that operating system.
2. Don't stop at uninstalling the extension: the malware leaves separate startup scripts running.
3. From a different, trusted computer, rotate every password, token and API key that machine could reach, and sign it out of GitHub and your hosting accounts.
4. Decide with whoever runs your IT whether to rebuild the machine.

Write down what you checked and when. A dated note beats a memory if a client asks later.

Which AI coding extension controls should a small team turn on?

Cursor documents three AI coding extension controls in its extension settings. The first is aimed squarely at incidents like this one.

• An install cooldown. Admins set a number of hours a new extension version must be public before anyone on the team can install it. The default is zero, which means off. That catches short-lived malicious uploads like this one. For most small teams we'd start at a day or two.
• An allowlist. Admins list the publishers or extension IDs the team may install, and everything else is blocked. It wouldn't have stopped this fake, which carried the real extension's name, but it keeps unknown add-ons off your machines.
• Signature verification. Enterprise teams can require a valid signature before an extension installs.

Cursor's security hardening guide notes that most org-wide enforcement is an Enterprise feature, so check your plan. Without it, a written list of approved extensions and a "wait a day before updating" habit cover most of the ground.

The longer-term fix is to keep production secrets off laptops. Developers should work with separate test keys that have spending limits, and live keys should sit in your hosting platform's secret store. We covered the wider launch checklist in vibe coding security.

What should you ask contractors who build for you?

If an agency or freelancer builds your app with AI tools, their laptop is part of your risk. Ask which AI coding extensions they use and whether they checked for this incident. Put extension rules and key handling in the contract, and make sure you can revoke their access in minutes.

Frequently asked questions

Was the official Claude Code extension affected?

No. Microsoft says the bad versions only appeared in Cursor's marketplace, not in Microsoft's Visual Studio Marketplace or Anthropic's npm package.

Does uninstalling the extension remove the backdoor?

No. Cursor says the malware drops startup scripts that keep running, so use the remediation script and rotate credentials.

Are VS Code users at risk from a fake AI coding extension?

This incident was limited to Cursor's marketplace, but any editor that runs extensions carries the same kind of risk.

Should we stop using AI coding tools?

No. Treat them like any software that touches your code and credentials: approved AI coding extensions, a short wait before updates, and no live secrets on laptops.

Who should own this in your business?

One named person should own the list of approved AI coding extensions and the plan for revoking access, even if your developers are external. If you have an AI-built app heading to production and aren't sure who holds that job, our Prototype to Production team can review where its keys live and who can reach them, and our IT services team can keep watch after launch.