Malicious Claude Code Extension Reached Up to 5,000 Cursor Users

The compromised extension was available for Windows, macOS and Linux through Cursor’s integrated development environment marketplace. Cursor said no more than 5,000 users downloaded it. Extensions update automatically by default in Cursor, though users can change that setting, and the affected version was later replaced with a newer one.

The malware was built to establish persistent remote access. Cursor said it attempted to add an attacker-controlled SSH key, activate the device’s SSH service and create a reverse SSH connection. Because extensions can use the permissions of the development environment, an installed version could potentially reach local files, source code and developer tools.

A flaw in the malicious code prevented it from fully taking hold on most affected devices, according to the account of the incident. Cursor temporarily closed its extension marketplace while investigating, then provided steps for users to address the threat.

Anthropic staff said the company’s own systems and employee computers were not compromised, and that Anthropic had neither built nor published the tampered extension. The affected copies appeared through Cursor’s marketplace; versions distributed through Anthropic’s official channels were not affected.

The route by which the attacker obtained access to Cursor’s marketplace remains unexplained. Cursor has not publicly detailed how the upload occurred. Security researchers described the incident as a supply-chain attack involving access to an official distribution channel.