Malicious Claude Code Extension Hit 5,000 Cursor Users — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Cursor's extension marketplace hosted a tampered copy of Anthropic's Claude Code extension for roughly 11 hours on Thursday, and the company says the rogue extension was downloaded by "at most 5,000 users" on Windows, macOS, and Linux.
- The backdoor was designed to give attackers access to victim devices — the type of implant malicious hackers often use as a stepping stone to deeper control inside a target network — but a flaw in the malware's design blocked it from fully establishing itself on the vast majority of targets.
- Cursor briefly shut down its extension marketplace while investigating, said no other extensions were impacted, and published remediation steps on Thursday for the roughly 5,000 affected targets; the company did not answer WIRED's request for comment about how the malicious upload happened or whether it resulted from a breach at Cursor.
- Anthropic technical staff member Felix Rieseberg said the company is working with Cursor on the incident but it wasn't a compromise of Anthropic's systems or employee laptops: a malicious actor used access to Cursor's marketplace to publish a tampered copy Anthropic did not build or publish, and versions on official channels were not affected.
- David Dworken, who works on security at Anthropic, said the incident did not involve a compromise of any Anthropic systems, countering researchers' initial speculation that the extension came from a compromised Anthropic system; Anthropic was not involved with building, publishing, or hosting it.
- Phorion was the first to spot the malicious extension, after researchers at the detection firm found it on a customer's Mac; cofounder and CEO Calum Hall said, "Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker."
Why it matters: For Cursor's developer base, the 11-hour exposure was contained by a marketplace shutdown and Thursday remediation steps rather than an Anthropic breach; Anthropic says official channels were unaffected. The backdoor's own design flaw blocked it from fully establishing on the vast majority of affected machines, sparing the roughly 5,000 downloaders a confirmed foothold.
Ask SkimNews
