Cyber ·
Security notice on a compromised Claude Code extension for VS Code
Radar entry for October 30, 2026: the oss-sec list published an advisory by Henri Salo about a compromised Claude Code extension for VS Code. Cursor also published a related security notice. The indexed text gives only the title and the notice, with no technical details.
On October 30, 2026, Henri Salo published on the oss-sec list a security advisory about the Claude Code extension for VS Code, described as compromised. The post was carried in the oss-sec feed as a machine translation. A related post on the Cursor blog covers a security notice tied to the same extension. The material available for this entry contains only the title, the date, the author, the reference to the Cursor notice and the statement that the extension was affected. The indexed text does not describe the attack vector, the affected versions, the fix date or indicators of compromise, and this entry does not invent them. For teams, the relevant lesson is risk management for development tools: editor extensions can reach source code, local files and often credentials, so they deserve the same installation controls as other software. Rota Nacional does not fix the extension, does not detect malicious code on a developer's machine and does not replace the vendor's notice. It protects what passes through your API: the personal data detector applies the organization's policy before any model runs, and the raw content stays only in the encrypted audit archive. To consult and verify, open the original advisory on the oss-sec list and the Cursor notice through official channels, check the versions and recommendations they cite, and compare them with the version installed in your organization.
Original source: Re: Extensão Claude Code para VS Code comprometida