Malicious Claude Code Extension Reached Up To 5,000 Cursor Users
A tampered Claude Code extension appeared in Cursor’s marketplace for about 11 hours, though a flaw prevented its backdoor from fully establishing itself on most devices.
A malicious copy of Anthropic’s Claude Code extension was available in Cursor’s extension marketplace on Thursday, exposing users of the AI development platform to a backdoor. Cursor said the extension was downloaded by at most 5,000 users, according to Wired. The company briefly shut down its marketplace to investigate and published remediation steps for affected users.
Table of Contents
What appeared in the marketplace
Wired reported that the tampered extension was available for Windows, macOS and Linux for roughly 11 hours. Ars Technica described the period as nearly 12 hours. Cursor said no other extensions were affected, according to Wired.
The extension was designed to give attackers access to devices on which it was installed. Wired described that access as a potential foothold for deeper control within a target network. Phorion, a detection firm, first spotted the malicious extension after finding it on a customer’s Mac. Its cofounder and CEO, Calum Hall, told Wired that a flaw in the malware’s design prevented it from fully establishing itself on the vast majority of targets. That limitation does not change the need for users who downloaded the extension to follow Cursor’s published remediation steps.
How it got there remains unclear
The reports do not establish how the attackers published the extension. Ars Technica said it remained unknown how they gained access to Anthropic’s verified Cursor account. Wired reported that some researchers initially suspected a compromised Anthropic system, but said the upload mechanism was still unclear.
Citing Cursor’s security alert, Wired reported that Anthropic did not develop the malicious versions. Anthropic technical staff member Felix Rieseberg said the incident did not involve compromised Anthropic systems or employee laptops. He said a malicious actor used access to Cursor’s marketplace to publish a tampered copy that Anthropic had neither built nor published. Anthropic security employee David Dworken also said the company was not involved in building, publishing or hosting it.
Rieseberg said versions distributed through Anthropic’s official channels were unaffected and that the incident affected only Cursor users. Wired said Cursor did not answer its questions about how the upload occurred or whether Cursor itself had been breached.
What developers should take from the alert
For developers and teams using Cursor, the immediate issue is whether they downloaded the marketplace version during the window identified by the reports. Cursor’s remediation guidance addresses those users, while the malware flaw means a download should not be treated as proof that the backdoor fully established itself. The accounts leave the route into the marketplace unresolved.
Sources
This story was compiled by AI from the reports below. Read the originals for the full details.