A malicious version of Anthropic’s Claude Code extension was available for about 11 hours in Cursor’s extension marketplace on Thursday, potentially exposing up to 5,000 Windows, macOS, and Linux users to a backdoor. Cursor, the AI software development platform owned by SpaceX, has temporarily shut down the marketplace while it investigates. The company says no other extensions were affected.
A backdoor with limited impact
The tampered extension was designed to give an attacker access to a victim’s device. Such implants are often used as an initial foothold for gaining deeper control of a target network.
Cursor published a security notice saying it would take remediation measures on approximately 5,000 affected targets on Thursday. However, a design flaw in the malware prevented it from fully establishing itself on most devices.
“Everyone here was very lucky. This could have been a very dangerous foothold for an attacker,” said Calum Hall, co-founder and CEO of detection company Forion and the original researcher who identified the malicious extension on a customer’s Mac.
Anthropic says its systems were not compromised
It remains unclear how the malicious extension entered the Cursor Marketplace. Some researchers initially speculated that it may have originated from a compromised employee system. Cursor said in its security alert that “these malicious versions of the extension were not developed by Anthropic.”
Felix Rieseberg, a member of Anthropic’s technical staff, wrote on X on Friday that Anthropic was working with Cursor on the incident.
“We are working with Cursor on this incident, but it was not a compromise of Anthropic’s systems or employee laptops. A malicious attacker used access to Cursor’s marketplace to publish a modified copy of the Claude Code extension, which we did not build or publish. The version on our official channels is not affected, and this was not a compromise of Anthropic’s systems or employee laptops. It only affects users.”
David Dworken, Anthropic’s head of security, said shortly afterward: “This did not involve compromising any Anthropic systems…We were not involved in building, publishing, or hosting this.”
Cursor did not respond to WIRED’s request for comment about how the malicious upload occurred or whether it resulted from a breach of Cursor’s systems.
Source: www.wired.com
