GLOBAL – October 30, 2026 -- A maliciously modified build of the Anthropic.claude-code extension, version 2.1.313, sat in the Cursor VS Code Extension Marketplace for about 11 hours on October 29, 2026, potentially exposing up to 5,000 users, according to Cursor. Anthropic did not develop the malicious version.