Cursor says up to 5,000 users affected by tampered Claude Code extension

Oct 30 : Cursor, the coding-tool company owned by SpaceX, said on Friday that a maliciously modified version of Anthropic’s Claude Code extension was available on its Cursor VS Code extension marketplace on Thursday, affecting up to 5,000 users.

Here are some details:

• Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday

• The extension attempted to collect host and user information such as hostname, username, operating system and public IP address

• It also attempted to set up remote access for the attacker; Cursor said a key step would have failed on most machines because it requires administrator rights

• Upon detection, Cursor removed the malicious version and blocked its distribution and shut down the marketplace as a precaution

• The company then rebuilt the marketplace and brought it back online, it said

• Cursor said the incident did not impact other extensions on its marketplace

• Anthropic did not immediately respond to a request for comment