The familiar AI name was not the security check.

A familiar name on an extension is not proof that the package came from the people you think it did. Cursor's notice makes that distinction unusually concrete. The company identified malicious versions 2.1.312 and 2.1.313 of Anthropic.claude-code in its own extension marketplace for Windows and macOS on October 29. Cursor says these versions were not developed by Anthropic and reports no evidence that the official distribution or other versions were affected. This is a software-delivery incident, not evidence that the Claude model decided to attack its users. According to the notice, the modified packages collected host information and attempted persistent remote access. Some actions were limited by privileges and implementation errors. That is a reason to describe the incident precisely, not a reason to skip checking an affected machine. Cursor removed the packages, rebuilt the marketplace and worked to disable the attacker's infrastructure. The immediate lesson is to use the vendor's affected-version and remediation guidance. Removing an extension alone may leave other changes behind; organizations should route affected systems through their incident-response process. The broader lesson is about where trust gets attached. We often recognize the model provider and stop asking how software reached our machine, who can update it, or what access an extension receives. Yet those are separate relationships with separate failure modes. A powerful coding assistant does not make software provenance an old-fashioned concern. It makes the path between a trusted brand and an executable package worth examining more carefully. Security work starts before the first prompt.