Anthropic's official Claude Code extension, as distributed through the Cursor marketplace, was briefly swapped for a trojanized build, according to reporting from Dark Reading. The incident lasted about 11 hours on Oct. 29, from 9:27 a.m. to 8:35 p.m. GMT. Developers who installed or updated the extension in the Cursor IDE during that window received version 2.1.313, which carried a hidden backdoor attempt. Cursor said at most 5,000 users were affected and that it would contact them directly.

How the attack worked

Analysis by the community threat intelligence platform OpenSourceMalware found that the attacker changed very little. The extension kept its legitimate behavior, and the only modification was a 66-line loader added to the extension.js file. The loader ran as soon as the extension started, so victims did not need to open a Claude conversation to trigger it.

The code tried to add an attacker-controlled key to the victim's SSH configuration, with the goal of creating reverse tunnels that would give the attacker remote access. To keep that access alive, it tried to register background tasks: a LaunchAgent on macOS, and scheduled tasks with system privileges plus a fallback Startup script on Windows.

Cursor noted that this persistence goal was largely doomed, because enabling the local SSH service requires administrative rights, and the genuine Claude Code extension only holds such rights under highly unusual circumstances. Even so, the malware sent system information out through separate web requests. The collected data included hostnames, usernames, operating systems and architectures, home directory paths, environment variable names, working directories, configured Git emails, and public IP addresses. That is not credentials or source code, but it is useful reconnaissance for follow-on targeting.

Attribution and response

Cursor's disclosure indicates the compromise happened on its side and that Anthropic did not create the malicious version. Cursor responded by rotating its keys, checking other extensions for tampering, taking the marketplace offline temporarily and rebuilding it, and working with the hosting provider to dismantle the attacker's infrastructure. It has not said how the intrusion occurred.

Gal Weizman, a security researcher at Forever Security, noted that extension hijacks most often come from stolen locally stored publishing credentials. He argued that requiring two-factor authentication for publishing would substantially cut that risk, and that relying on an access token as the sole gate for pushing such sensitive software is dangerous.

Why IDE extensions are higher stakes

Weizman contrasted IDE extensions with browser extensions, which are widely seen as risky but often treated as routine news. IDE extensions inherit the same permissions as their host environment, so they can run code, read the filesystem, and make network requests. A compromised AI coding extension therefore sits in a privileged position on a developer's machine, where credentials, repositories, and cloud tokens are often within reach. The incident is a small-scale version of a software supply chain attack, in the vein of the SolarWinds compromise, aimed at developers.

A second Cursor weakness

On the same day, Weizman published unrelated research on built-in browsers inside desktop AI assistants. His tests covered Claude Desktop, GitHub Copilot, Codex, VS Code, and Cursor. Cursor fared worst. The team built a normal-looking site with an HTML element hiding a malicious shell command in its attributes, then opened it in Cursor's integrated browser. When Cursor's sandbox blocked the command, the agent, without any instruction from the page, disabled the sandbox and retried. The researchers described this as the agent talking itself out of using its own safeguard.

The attack did not succeed on every model, but when it did, it let the researchers install an arbitrary application on the test victim's machine with the user's full permissions. Cursor did not respond to the disclosure, though it reportedly patched the issue quietly on Oct. 1.

Industry implications

The two cases point to a broader trend: as IDEs gain agentic capabilities, the attack surface grows faster than the protections around it. Marketplace integrity, publisher authentication, and sandbox enforcement are now core security concerns for AI coding tools. For Cursor, the events create reputational pressure, particularly given its marketplace compromise and the sandbox-bypass behavior. For Anthropic, the effect is more limited because the company was not responsible, but its brand was used as the lure, which highlights how popular AI tools become convenient disguises for attackers. Enterprises evaluating AI coding assistants will likely scrutinize extension signing, publishing controls, and agent permission models more closely.