Malicious Claude Extension Hit 5,000 Cursor Users

The AI coding platform Cursor, owned by SpaceX, hosted a trojanized version of the Anthropic Claude Code extension across Windows, macOS, and Linux for roughly 11 hours before pulling it. Up to 5,000 users downloaded the tainted extension, which contained a backdoor intended to give attackers persistent access to victim machines — a common entry point for deeper network compromise.

Detection firm Phorion was first to flag the malicious extension after spotting it on a customer's Mac. CEO Calum Hall called the situation 'potentially a really dangerous foothold for an attacker,' but noted that a flaw in the malware's own code prevented it from fully installing on most affected systems. Cursor briefly shut down its entire extension marketplace while investigating, confirming no other extensions were affected, and published remediation steps for impacted users.

Both Anthropic and Cursor were quick to distance themselves from the source of the compromise. Anthropic's Felix Rieseberg stated on X that 'a malicious actor used access to Cursor's marketplace to publish a tampered copy,' while security staffer David Dworken confirmed no Anthropic systems were involved. Cursor has not publicly explained how the malicious upload bypassed its review process, and did not respond to WIRED's questions about whether Cursor itself was breached.