Malicious Claude Code Extension Slips Into Cursor Marketplace, Reaching Up to 5,000 Users

A tampered Anthropic Claude Code extension sat in Cursor's integrated development environment marketplace for about 11 hours on Thursday, reaching what the company says was "at most 5,000 users" across Windows, macOS, and Linux.

The extension carried a backdoor meant to give attackers access to victim machines-the kind of implant used as a stepping stone toward deeper control of a network. Cursor shut the marketplace down briefly during its investigation and says no other extensions were affected, and it published remediation steps for affected users on Thursday.

A design flaw in the malware stopped it from fully establishing itself on most targets. "Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker," said Calum Hall, cofounder and CEO of detection firm Phorion, whose researchers were first to spot the extension after finding it on a customer's Mac.

How the extension got into the marketplace remains unclear. Cursor said the malicious versions "were not developed by Anthropic," and Anthropic's Felix Rieseberg wrote on X that the incident "wasn't a compromise of Anthropic's systems or employee laptops," describing it instead as a malicious actor using access to Cursor's marketplace to publish a tampered copy. Anthropic security staffer David Dworken said the company "was not involved with building, publishing, or hosting this." Cursor did not respond to a request for comment on how the upload happened or whether it resulted from a breach at the company.

Source: Wired