Cursor Pulls Malicious Claude Code Extension After Supply Chain Attack

A malicious version of Anthropic's Claude Code extension sat inside Cursor's developer marketplace for roughly 11 hours on Thursday, and Cursor says up to 5,000 users downloaded it before the company pulled it down, according to WIRED. Cursor, the AI coding platform owned by SpaceX, briefly shut down its entire extension marketplace while it investigated, and the company says no other extensions were affected.

What exactly got downloaded onto developer machines?

The tainted file was built to work on Windows, macOS, and Linux, and it carried a backdoor — a hidden entry point attackers use to get a foothold on a device and, often, to move deeper into a company's network from there, WIRED reports. The extension was designed to look like the real Claude Code tool that developers use inside Cursor's environment to write and manage code with AI help.

How many machines were actually hit?

Cursor's own figure, cited in its Thursday security alert, puts the number at "at most 5,000 users." That is the company's own estimate of downloads, not a confirmed count of machines that were fully compromised. Cursor published remediation steps the same day for anyone who installed the extension during the 11-hour window.

How did a fake extension get into Cursor's marketplace in the first place?

That part is still unresolved. Some researchers initially guessed the problem traced back to a breach of Anthropic's own systems, but both companies pushed back on that theory. Cursor's security alert states plainly that "these malicious versions of the extension were not developed by Anthropic."

Anthropic staff went further on X. Felix Rieseberg, a member of Anthropic's technical staff, wrote Friday: "We're working with Cursor on this incident, but it wasn't a compromise of Anthropic's systems or employee laptops. A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected and this only impacts Cursor users."

Anthropic security staffer David Dworken posted separately that "this did not involve a compromise of any Anthropic systems … We were not involved with building, publishing, or hosting this." Cursor did not respond to WIRED's request for comment on how the malicious file was uploaded or whether its own marketplace controls were breached.

Why didn't the malware do more damage?

A coding flaw in the malware itself kept it from fully installing on most machines that downloaded it, limiting the real-world damage even though the backdoor was live for nearly half a day. Calum Hall, cofounder and CEO of the detection firm Phorion, was the first researcher to spot the malicious extension, catching it on a customer's Mac.

"Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker," Hall said.

That framing matters because a backdoor on a developer's machine is rarely the end goal for an attacker. It is typically the opening move — a way to get inside a company's broader systems once the developer's credentials, source code, or network access are exposed. The flaw that blocked full installation is the reason this incident is being described as a near miss rather than a confirmed breach of downstream systems.

What should developers who use Cursor do now?

Anyone who installed the Claude Code extension through Cursor's marketplace on Thursday, during the roughly 11-hour window the tainted version was live, should follow the remediation steps Cursor published that day. Cursor has not detailed publicly, in material reviewed for this story, exactly what those steps require beyond removing and replacing the compromised extension, so affected users should check Cursor's own alert directly for the current instructions rather than relying on secondhand summaries.

What to watch next

• Whether Cursor identifies how the malicious file was published to its marketplace, and whether that points to a gap in its upload or review process.
• Whether Anthropic or Cursor confirms any cases where the backdoor fully activated on the roughly 5,000 machines that downloaded it.
• Whether other AI coding platforms that run third-party extension marketplaces tighten review processes in response.
• Any follow-up findings from Phorion, the firm that first flagged the malicious extension on a customer device.

For now, both companies agree on one point: the extension did not come from Anthropic's own build or publishing pipeline, and the incident is confined to users who downloaded the compromised file through Cursor during that single Thursday window.