A tampered Claude Code extension stayed on the Cursor marketplace for roughly 11-12 hours, affecting up to 5,000 users, and attempted remote access and data theft. Cursor took the marketplace offline; it is still unknown how attackers accessed Anthropic's verified Cursor account.
A tampered Claude Code extension stayed on the Cursor marketplace for about 11 hours, affecting up to 5,000 users, and attempted to steal user data and set up remote access. Cursor took the entire marketplace offline and brought it back after confirming there was no further issue.
Why it matters: It shows that AI coding-assistant extensions distributed through marketplaces can be hijacked to try to access user data and systems.
Written by AI from The Decoder's published text.
Background
From our own funding, model and news trackers, not from the source.
- Last 30 days
- 4 news stories
More coverage of this story (1)
Anthropic's Claude Code extension on Cursor marketplace compromised
Primary source
“A tampered Claude Code extension was live on the Cursor marketplace for about 11 hours, affecting up to 5,000 users. It tried to steal user data and set up remote access.”
Reporting from a publisher outside the organisation being covered.
Read original story ↗