Malicious Claude Code Extension Hit Cursor Marketplace, Up to 5,000 Downloads
Cursor pulled the tampered Anthropic extension after detection firm Phorion spotted it on a customer's Mac and published remediation steps for affected users.
A tampered copy of the Anthropic Claude Code extension was published in Cursor's extension marketplace and downloaded by at most 5,000 users before Cursor removed it, the company said. The malicious versions were available for about 11 hours on Thursday, according to WIRED.
The rogue extension was built for Windows, macOS, and Linux and contained a backdoor intended to give attackers access to victims' devices. A design flaw in the malware prevented it from fully installing on most affected devices, Cursor said.
Phorion, a detection firm, was the first to spot the extension after finding it on a customer's Mac. Calum Hall is cofounder and CEO of Phorion.
Cursor briefly shut down its marketplace during the investigation and said no other extensions were affected. It published remediation steps for the roughly 5,000 affected users on Thursday.
Anthropic says its systems were not compromised
Cursor stated that the malicious extension versions were not developed by Anthropic. Anthropic's Felix Rieseberg said the incident was not a compromise of Anthropic systems or employee laptops, and Anthropic security staffer David Dworken said the company was not involved in building, publishing, or hosting the malicious extension.
It remains unclear how the malicious extension entered the marketplace. Cursor did not respond to WIRED's request for comment on how the upload happened or whether it resulted from a breach at Cursor. Cursor is owned by SpaceX.
Quick answers
How many users downloaded the malicious Claude Code extension from Cursor?
At most 5,000 users downloaded it, according to Cursor, which published remediation steps for those affected.
Did the malware fully install on affected devices?
A design flaw in the malware prevented it from fully installing on most affected devices, Cursor said.
Was Anthropic's own infrastructure compromised?
Anthropic's Felix Rieseberg said the incident was not a compromise of Anthropic systems or employee laptops.