SpaceX-owned AI software development platform Cursor says a malicious version of Anthropic’s Claude Code extension was available in its marketplace for Windows, macOS and Linux for about 11 hours on Thursday. The extension may have been downloaded by up to 5,000 users. Cursor has temporarily shut down the marketplace while it investigates, and says no other extensions were affected.
Malicious extension contained a backdoor
The altered extension contained a backdoor that could allow an attacker to access a victim’s device. Such implants are often used by malicious hackers as an initial foothold for gaining deeper control over a target network.
Cursor said it would take remediation measures on approximately 5,000 affected systems on Thursday. However, a design flaw in the malware prevented it from fully establishing itself on most targets.
“Everyone here was very lucky. This could have been a very dangerous foothold for an attacker,” said Calum Hall, co-founder and CEO of detection company Forion and the original researcher who identified the malicious extension on a customer’s Mac.
Anthropic says its systems were not compromised
It remains unclear how the malicious extension entered the Cursor Marketplace. Some researchers initially speculated that it may have originated from a compromised employee system. Cursor said in a security alert on Thursday that “these malicious versions of the extension were not developed by Anthropic.”
Felix Rieseberg, a member of Anthropic’s technical staff, said on X on Friday that Anthropic was working with Cursor on the incident, but that it did not involve a compromise of Anthropic’s systems or employee laptops.
“A malicious attacker used access to Cursor’s marketplace to publish a modified copy of the Claude Code extension, which we did not build or publish,” Rieseberg wrote. “The version on our official channels is not affected, and this was not a compromise of Anthropic’s systems or employee laptops. It only affects users.”
David Dworken, Anthropic’s head of security, said shortly afterward that the incident “did not involve compromising any Anthropic systems” and that Anthropic was not involved in building, publishing or hosting the malicious extension.
Cursor did not respond to WIRED’s request for comment about how the malicious upload occurred or whether it resulted from a breach of Cursor’s systems.
Source: www.wired.com