Malicious Claude Code extension sat in Cursor's marketplace for about 11 hours
A tampered version of Anthropic's Claude Code, carrying a backdoor, was available in the marketplace of the AI coding platform Cursor for roughly 11 hours. Cursor says at most 5,000 users downloaded it.
A malicious extension posing as Anthropic's Claude Code tool was live for roughly 11 hours on Thursday in the extension marketplace of Cursor, an AI software-development platform owned by SpaceX. It was built for Windows, macOS, and Linux. Cursor says at most 5,000 users downloaded it. The incident matters because such extensions run on developers' machines, which can give attackers a route into wider networks.
What the extension did
The tampered extension contained a backdoor meant to give attackers access to victims' devices. Hackers often use this kind of implant as a stepping stone to deeper control inside a target network. However, a flaw in the malware's design stopped it from fully establishing itself on the vast majority of affected devices.
Cursor briefly shut down its extension marketplace to investigate and says no other extensions were affected. On Thursday it published remediation steps for the roughly 5,000 affected users.
Researchers at the detection firm Phorion were the first to spot the problem, after finding the extension on a customer's Mac. Calum Hall, Phorion's cofounder and CEO, said everyone was lucky, since it could have been a dangerous foothold for an attacker.
How it got there is unclear
It is still unknown how the extension reached Cursor's marketplace. Some researchers first speculated that it came from a compromised Anthropic system, but Cursor's security alert said the malicious versions were not developed by Anthropic.
Felix Rieseberg, a member of Anthropic's technical staff, wrote on X on Friday that the incident was not a compromise of Anthropic's systems or employee laptops. He said a malicious actor used access to Cursor's marketplace to publish a tampered copy of Claude Code, that the versions on Anthropic's official channels are unaffected, and that only Cursor users are impacted. David Dworken, who works on security at Anthropic, added that the company was not involved in building, publishing, or hosting the extension.
Cursor did not respond to WIRED's request for comment on how the upload happened and whether it resulted from a breach at Cursor.
