A supply chain attack placed a malicious Anthropic Claude Code extension on the Cursor AI software-development platform, affecting users across Windows, macOS, and Linux. The rogue software remained live in the integrated development environment extension marketplace for approximately 11 hours.
The Impact and Mitigation
Cursor, owned by SpaceX, stated that the unauthorized extension was downloaded by up to 5,000 users. Following the discovery, the platform temporarily shut down its extension marketplace to investigate the incident, noting that no other extensions were affected.
The fraudulent extension featured a backdoor intended to grant attackers access to victim devices, functioning as an implant to establish deeper control within a target network. Cursor released remediation guidance for the impacted individuals. However, a design flaw within the malware prevented it from fully executing on the vast majority of targeted devices.
Calum Hall, cofounder and CEO of detection firm Phorion—which first identified the malicious extension after spotting it on a customer’s Mac—stated to WIRED, “Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker.”
Investigation Into the Breach
The exact method by which the malicious extension entered the Cursor marketplace remains undetermined. While some researchers initially suspected a breach of Anthropic systems, Cursor clarified in a security alert that Anthropic did not develop the malicious versions.
Felix Rieseberg, a member of Anthropic’s technical staff, addressed the incident on X, stating that the company is collaborating with Cursor. He clarified that the event did not stem from a compromise of Anthropic systems or employee laptops, explaining that an attacker utilized access to Cursor’s marketplace to publish a tampered copy of the extension. Rieseberg emphasized that official channels remain unaffected and the issue is limited to Cursor users.
David Dworken, a security specialist at Anthropic, reinforced this statement on X, confirming that no Anthropic systems were compromised and the company had no involvement in building, publishing, or hosting the tampered software.
Cursor did not respond to inquiries from WIRED regarding how the malicious upload occurred or whether the incident stemmed from a security breach at Cursor itself.
