Breaking

Cursor Warns Uninstalling Poisoned Claude Code Extension May Not Remove Backdoor

October 30, 2026 at 19:48 EDT

Security
Software Dev & Coding

Cursor has warned that a compromised build of an extension for Claude Code, which it distributed to as many as 5,000 users, may keep running a backdoor even after the extension is uninstalled, and that updating it may not remove the threat either.

Security warning · Cursor

A compromised Claude Code extension may keep a backdoor after update or removal

Cursor warns that a tainted build distributed to as many as 5,000 users may retain access even after the extension is uninstalled or updated. Treat any installation of the affected build as potentially compromised.

Up to 5,000

users may have received the malicious build (an upper bound, not a confirmed count)

2 fixes

Update and uninstall, the usual remediation steps, may not remove the threat

Unconfirmed

Exact mechanism, full capabilities, distribution path, and any data taken

Scale of exposure

Each block = 100 users. Shown at the reported upper bound of 5,000.

1,0001,0001,0001,0001,000

Takeaway: 50 blocks = up to 5,000 users. The true number is not confirmed and may be lower.

Why the usual fix may fail

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.