Supply Chain Breach: Malicious Claude Code Extension Infects Thousands of Developer Systems

A significant supply chain security incident has unfolded involving the AI software-development platform Cursor, which is owned by SpaceX. A malicious version of the Anthropic Claude Code extension for Windows, macOS, and Linux was live in Cursor’s integrated development environment extension marketplace for approximately 11 hours on Thursday. According to the company, this rogue extension was downloaded by at most 5,000 users before it was identified and removed. In response to the threat, Cursor temporarily suspended the extension marketplace to conduct a thorough investigation, assuring that no other extensions were impacted by the breach. The tainted extension was engineered with a backdoor, a type of implant commonly used by malicious hackers as a stepping stone to gain deeper control within a target network. While the potential for damage was severe, a critical flaw in the malware’s design prevented it from fully establishing itself on the vast majority of the affected devices. Cursor has since published detailed remediation steps for the roughly 5,000 potentially compromised targets to help secure their systems against further exploitation. Calum Hall, cofounder and CEO of the detection firm Phorion, who first spotted the malicious extension on a customer’s Mac, emphasized the gravity of the situation. “Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker,” Hall stated, highlighting how close the industry came to a widespread compromise. The incident underscores the fragility of third-party integrations in modern development workflows. The exact mechanism by which the malicious extension entered the Cursor marketplace remains unclear. Initial speculation among researchers suggested a compromise of Anthropic’s systems; however, Cursor clarified in its security alert that the malicious versions were not developed by Anthropic. Felix Rieseberg, a member of Anthropic’s technical staff, confirmed on X that the incident did not involve a compromise of Anthropic’s systems or employee laptops. He explained that a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which Anthropic did not build or publish. David Dworken, an Anthropic security specialist, further reiterated that the company was not involved in building, publishing, or hosting the malicious code, and that official channels remain unaffected.