A malicious version of the Anthropic Claude Code extension was distributed through the Cursor marketplace, affecting up to 5,000 users across Windows, macOS, and Linux systems. The incident, which lasted approximately 11 hours on Thursday, represents a significant supply chain attack against the AI software-development platform owned by SpaceX.
Cursor temporarily suspended its extension marketplace to investigate the breach. The company stated that the rogue software was designed with a backdoor, a type of implant that allows attackers to gain initial access to a device and potentially move deeper into a target network. Remediation steps were published on Thursday for the affected users.
Flaw in Malware Design Limited Impact
Despite the severity of the threat, the damage was contained due to a structural flaw in the malware. Calum Hall, cofounder and CEO of detection firm Phorion, noted that the malicious extension failed to fully establish itself on the vast majority of targets. Hall, whose team was the first to identify the threat on a customer Mac, described the outcome as fortunate.
“Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker,” Hall said. The incident highlights the risks associated with third-party extensions in integrated development environments, where code often runs with elevated privileges.
Anthropic Systems Not Compromised
Initial speculation suggested that the malicious extension originated from a breach of Anthropic’s internal systems. However, both Cursor and Anthropic have clarified that their respective infrastructures were not compromised. The tampered version was uploaded directly to the Cursor marketplace by an external actor.
Felix Rieseberg, a member of Anthropic’s technical staff, posted on X that the incident did not involve a compromise of Anthropic systems or employee laptops. He emphasized that the malicious versions were not developed or published by Anthropic and that official channels remain unaffected.
David Dworken, a security engineer at Anthropic, reinforced this stance, stating that the company was not involved in building, publishing, or hosting the rogue extension. The versions of Claude Code available on official Anthropic channels are safe, and the incident is isolated to users of the Cursor platform.
Cursor has not yet provided details on how the malicious upload bypassed their security measures or whether the incident resulted from a breach of their own systems. The company has not responded to requests for further comment regarding the specific vulnerabilities exploited to allow the extension into the marketplace.
Source: Wired
