---
title: "Cursor's trojanized Claude Code extension hit up to 5,000 users; OpenAI cuts Cursor's models November 12"
description: "A trojanized Claude Code extension distributed through Cursor's own marketplace hit up to 5,000 users, and OpenAI pulls the editor's models on November 12, citing distrust of owner SpaceX. The $60 billion all-stock deal now sits on Space Exploration Technologies shareholders' books."
publisher: "The Inference"
section: "Security"
published: 2026-10-30T13:07:27.493Z
modified: 2026-10-30T13:07:27.493Z
canonical: https://theinference.org/article/cursor-s-trojanized-claude-code-extension-hit-up-to-5-000-users-openai-cuts-cursor-s-models-november-12
language: en
keywords: "Cursor, OpenAI, SpaceX, Cybersecurity, Supply Chain, Developer Tools"
---

# Cursor's trojanized Claude Code extension hit up to 5,000 users; OpenAI cuts Cursor's models November 12

> A trojanized Claude Code extension distributed through Cursor's own marketplace hit up to 5,000 users, and OpenAI pulls the editor's models on November 12, citing distrust of owner SpaceX. The $60 billion all-stock deal now sits on Space Exploration Technologies shareholders' books.

Cursor, [Anysphere](https://theinference.org/markets/companies/anysphere)'s AI code editor and [SpaceX](https://theinference.org/markets/companies/spacex)'s $60 billion acquisition, [disclosed on October 30](https://www.tradingview.com/news/reuters.com,2026:newsml_FWN46F3RV:0-cursor-ai-says-co-identified-security-incident-affecting-a-modified-claude-code-versus-code-extension-impacting-at-most-5-000-users/) that a modified, compromised Claude Code extension for VS Code was distributed through its own extension marketplace, affecting at most 5,000 users [1][2]. The company pulled the marketplace, worked with providers to remove the malware and reinstated it with new guidance, telling users to update Claude Code for VS Code to version 2.1.314 [1]. The tampered code was not written by [Anthropic](https://theinference.org/markets/companies/anthropic) [1].

## A backdoor hidden in a trusted update

The details sharpen the risk. The malicious build, version 2.1.313, appeared under Anthropic's legitimate extension ID and [carried a 66-line loader that added an attacker-controlled SSH key, installed persistence and sent host data to a remote server](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html) [5].

The captured material included the names of environment variables containing keys, tokens or secrets [5]. Cursor's analysis puts the exposure window at roughly 2:27 a.m. to 1:35 p.m [5]. Pacific on October 29 [5]. Three days earlier, [JFrog's security researchers had reported 42 hijacked GitHub repositories](https://www.infoworld.com/article/4241474/attackers-compromised-42-github-repositories-by-using-files-too-large-to-be-searched.html) carrying payloads that fire when developers open folders in AI coding tools, Cursor among them [6]. What is new now is a confirmed, company-disclosed incident inside Cursor's own marketplace, not another research finding.

## The buyer of record: Space Exploration Technologies (SPCX) shareholders

[SpaceX paid $60 billion in stock for Cursor](https://theinference.org/article/musk-paid-60-billion-for-cursor-openai-just-hired-its-two-top-sellers), closing on August 14 and [folding the editor into SpaceXAI, SpaceX's AI arm](https://aimagazine.com/news/cursor-the-ai-coding-agent-spacex-bought-in-a-us-60bn-deal), on about $2.6 billion of annualized B2B revenue, more than 50,000 customer teams and the majority of the Fortune 500 [3]. The purchase price rests on teams keeping their subscriptions, and the buyers include [Salesforce](https://theinference.org/markets/companies/salesforce), which reports developer velocity up more than 30%, and [NVIDIA](https://theinference.org/markets/companies/nvidia), whose 30,000 developers commit three times more code with Cursor [3].

Space Exploration Technologies (SPCX) trades at a $1.95 trillion market cap, 71.06 times sales near a one-year low against a 101.8 historical median, with negative trailing EPS [1]. Insider activity is one-sided: no insider purchases and $53.7 million of insider sales in the past year [1].

## The menu shrinks while the marketplace leaks

The breach lands in a month already crowded with trust questions for the company. [OpenAI](https://theinference.org/markets/companies/openai) stops supplying models on November 12, stating: "[We are making this choice because we cannot be confident that SpaceX will use our technology within our terms of service](https://shattered.io/openai-cuts-cursor-off-spacex-deal-2026/), based on our experience with [Elon Musk](https://theinference.org/markets/people/elon-musk)'s companies violating contracts" [4]. Chief executive [Michael Truell](https://theinference.org/markets/people/michael-truell) counters that OpenAI models serve about 5% of Cursor traffic [4].

Still, bundled OpenAI quotas vanish from Premium tiers, third-party models bill from the first token after the cutoff, and the $8 X Subscription Plus tier is Grok-only [4].

*Chart: **Cursor trails every rival in reported developer usage** Bar chart of 2026 Stack Overflow developer survey usage shares for four AI coding agents, with Cursor at 25.5 percent trailing Claude Code at 65.5 percent, GitHub Copilot at 58.7 percent and Codex at 29.5 percent.*

*Reported usage among respondents who use a listed AI coding agent, 2026 Stack Overflow Developer Survey, 30,903 valid responses across 169 countries; respondents could report multiple tools, so shares overlap. Source: [4]. [4]*

That chart is the pressure in numbers. A controlled test ran Cursor and Claude Code on the same Claude Sonnet 5.5 model against 186 hidden checks: both passed every run, seconds apart [4]. When the editor itself stops separating the tools, buyers choose on which models are bundled and how predictable the bill is, and [Cursor's bundled menu is thinning](https://theinference.org/article/cursor-stopped-bundling-claude-just-as-anthropic-courts-a-2-trillion-listing) while its marketplace carried malware [4].

## What Cursor's account limits

Cursor says the malicious build is removed, other extensions in its marketplace were not affected, and it is contacting impacted users directly [1][5]. The OpenAI cutoff touches about 5% of traffic by Truell's account [4], and Grok, bundled at $8, gains a distribution channel inside a widely used editor [4].

Claude models are among the frontier models developers can choose inside Cursor [3], and no source reports Anthropic restricting access. The unresolved problem is precedent: OpenAI has set the position that a model provider may cut a long-standing customer over who owns the parent [4].

## Renewals are the next reading

Enterprise renewal commentary and marketplace guidance through November are the figures to watch. The $60 billion price holds only while the teams that measure their coding tools closely keep paying; a disclosed breach and a shrinking bundled menu give buyers reasons to pause [1][3][4]. If renewals slow, the cost lands on [SPCX shareholders](https://theinference.org/markets/companies/spacex) who funded the deal in stock, and Claude Code, [GitHub](https://theinference.org/markets/companies/microsoft) Copilot and Codex CLI are positioned to collect [1][3][4].

## Takeaway

A trojanized Claude Code extension in Cursor's own marketplace touched up to 5,000 users; with OpenAI pulling models on November 12 and reported usage already trailing every rival, enterprise renewals are the next reading on the $60 billion SpaceX deal.

## Sources

1. [GuruFocus News, Cursor AI Coding Breach Highlights Risks Amid SPCX's Market Valuation Dynamics, 30 October 2026](https://www.gurufocus.com/news/9158319/cursor-ai-coding-breach-highlights-risks-amid-spcxs-market-valuation-dynamics)
2. [Reuters via TradingView, Cursor AI says company identified security incident affecting a modified Claude Code VS Code extension impacting at most 5,000 users, 30 October 2026](https://www.tradingview.com/news/reuters.com,2026:newsml_FWN46F3RV:0-cursor-ai-says-co-identified-security-incident-affecting-a-modified-claude-code-versus-code-extension-impacting-at-most-5-000-users/)
3. [AI Magazine, Cursor: The AI Coding Agent SpaceX Bought in a US$60bn Deal, 29 October 2026](https://aimagazine.com/news/cursor-the-ai-coding-agent-spacex-bought-in-a-us-60bn-deal)
4. [Shattered.io, OpenAI Cuts Cursor Off Nov. 12 Over SpaceX Deal [2026], updated 21 October 2026](https://shattered.io/openai-cuts-cursor-off-spacex-deal-2026/)
5. [The Hacker News, Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor, 30 October 2026](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html)
6. [InfoWorld, Attackers compromised 42 GitHub repositories by using files too large to be searched, 27 October 2026](https://www.infoworld.com/article/4241474/attackers-compromised-42-github-repositories-by-using-files-too-large-to-be-searched.html)


---

Cursor's trojanized Claude Code extension hit up to 5,000 users; OpenAI cuts Cursor's models November 12 — The Inference. Canonical: https://theinference.org/article/cursor-s-trojanized-claude-code-extension-hit-up-to-5-000-users-openai-cuts-cursor-s-models-november-12