An extension promises to save time, a colleague recommends it, and installation takes only seconds. In a small business, that decision deserves the same care as adding any new software. A recent alert involving a coding assistant shows why: a familiar product name does not establish where the installed file actually came from.
A specific alert, not a general accusation against AI
On 29 October 2026, Cursor reported malicious copies of the Claude Code extension, numbered 2.1.312 and 2.1.313, distributed through its marketplace for Windows and macOS. Its security notice, clarified on 30 October, describes their removal and attempts to establish persistent remote access.
In its analysis published on 30 October, Microsoft states that the affected packages were not distributed through the Visual Studio Marketplace or the official npm package. According to that analysis, Anthropic’s systems were not compromised. The distribution channel therefore matters as much as the name and version.
Who should check?
The first people to check are those developing, automating or maintaining applications with Cursor. A small business may also be concerned if an employee or supplier uses these tools on a workstation with access to its projects. Using Claude in a browser is not enough to establish exposure to this incident.
Our advice is to ask whoever manages your development work a straightforward question: “Did we install this extension from this marketplace during the stated period?” Ask for a documented check rather than an answer based only on the name displayed on screen.
Why choosing an extension deserves attention
A development extension can have significant access to a workstation. The VS Code documentation on extension security explains, for example, that extensions can read files, launch processes and make network connections. Additions to the working environment therefore deserve careful consideration.
For a team, we recommend keeping a short record for each tool: its purpose, publisher, approved official link, users and the person responsible for maintaining it. A shared table is enough. This makes it easier to respond when an alert arrives and avoids starting from scratch whenever someone joins or leaves.
Three useful habits before the next installation
Start with an identified need. Test the tool on a representative task and check what it actually contributes before rolling it out to the whole team.
Keep an approved installation route. Find the link through the publisher and record the package’s source. A sponsored search result, screenshot or familiar name does not replace that check.
Plan ongoing maintenance. Assign someone to monitor security notices and decide how updates should be handled. Keep a short list of extensions that are genuinely needed.
If a suspicious installation is found
Have the workstation examined before assuming the issue is resolved. Microsoft points out that uninstalling alone can leave persistent components behind. The investigation should determine the cleanup and any necessary access measures; avoid running commands found at random or deleting evidence that could help the diagnosis.
Would you like a clearer picture of the tools used in your organisation? Explore MYCIO’s cybersecurity support or contact us to review your needs and identify the next checks.
AI-generated illustration; it does not depict the actual interface of the software mentioned.