How-To: Inventory Your Cursor Extensions and Stop Silent Auto-Updates

The bad Claude Code build reached people as a normal update. Here’s how I keep an eye on what’s in my editor.

1. List what’s installed, with versions

cursor --list-extensions --show-versions | sort > ~/cursor-extensions.txt

Save it. Next time, diff against the old file to see what changed.

2. Check for the bad version

grep -i 'anthropic.claude-code@2.1.313' ~/cursor-extensions.txt
ls ~/.cursor/extensions | grep -i claude-code

3. Turn off silent auto-updates

In settings.json:

"extensions.autoUpdate": false

You’ll update by hand and can wait a day or two before taking new versions of anything with deep access.

4. Trim the list

Remove what you don’t use. Every extension runs with your user’s rights.

Review before you run anything: read the docs yourself, back up your config, and try it somewhere you can afford to break first.

God Bless, and Happy hacking!

References & Further Reading

• Cursor security notice: malicious Anthropic.claude-code 2.1.313
• Extension Marketplace: command line and auto-update (VS Code docs)