Malicious Claude Code Extension Hits Cursor Users

Anthropic did not build or publish either version. Felix Rieseberg, a member of Anthropic’s technical staff, said on X that its systems were not compromised: A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The fake never appeared on the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry, so only Cursor users were exposed, on both macOS and Windows. Anthropic is working with Cursor on the investigation.

Cursor removed the extension and suspended its marketplace, then rotated all keys and rebuilt the service before bringing it back. It also worked with the cloud provider hosting the attacker’s server to take it offline, and says its investigation found no other malicious extensions.

A Payload That Fired the Moment It Loaded

Researchers at Phorion found the malicious JavaScript planted at the very top of the extension’s main file, so it ran as soon as the extension loaded and before any normal activation. The user doesn’t need to interact with the extension for the payload to fire, the firm said.

The code was built to do three things: collect reconnaissance on the host, add an attacker-controlled SSH key to the user’s authorized_keys file, and open a reverse tunnel to a remote server. It also dropped platform-specific scripts and startup entries so the connection would survive restarts. Microsoft Threat Intelligence detailed what it collected: hostname, username, operating system, and the global Git email address. It also scanned environment variables for names containing KEY, TOKEN, SECRET, PASS, AWS, or GCP, and took the variable names rather than their values.

One step failed for most victims. Switching on the local SSH service requires admin rights, which most macOS and Windows systems did not grant, so attackers could not log in through the tunnel on those machines. That limits the damage, but not the cleanup.

Uninstalling Leaves the Spare Key Behind

Cursor warned that removing the extension is not enough, because the payload places standalone persistence scripts outside the extension’s install directory and they keep running. Steve Povolny, VP of AI strategy and security research at Exabeam, put it this way: Removing the extension only sends the visitor away while the spare key stays on the hook.

Cursor has released a detection script and published IoCs so teams can check their environments. For any host that ran the bad versions, the cleanup list is short but specific:

• Isolate any machine showing signs of payload execution or backdoor installation
• Remove unauthorized keys from authorized_keys, and verify the key’s fingerprint, as Phorion advises
• Kill running tunnel processes and delete the persistence scripts and startup entries
• Rotate exposed credentials and review logs for logins from unfamiliar keys

Povolny stressed the last point because developer workstations tend to hold access to critical resources, which makes one compromised laptop a gateway into enterprise systems. Yash Kadakia, founder and CTO of Security Brigade, argued that enterprises should treat extension marketplaces as part of the software supply chain: When malicious code can reach developers through what appears to be a legitimate, routine update, the traditional assumption that software from a trusted marketplace is safe starts to break down. He called for stronger publisher verification, package integrity checks, and controls such as allowlisting. The incident follows other recent compromises, including LiteLLM and AOMEI Backupper, and fits a wider pattern of supply chain attacks on developer tooling.

Hashlytics Take

The attackers did not break Anthropic or beat any code signing. They got into Cursor’s marketplace and published under a name developers already trusted, which means the extension’s reputation did the work that a phishing lure normally has to do. That is why the 11-hour window matters more than the 5,000 estimate. Auto-updating extensions run with the developer’s full user privileges the instant they load, so exposure scales with how fast the update reaches people, not with how clever the payload is. And this payload was not especially clever: it stalled on an admin prompt. A developer who had already enabled SSH on their machine is a different story, and nothing in the attack depended on luck beyond that one permission. Teams that pin extension versions and restrict installs to an allowlist would have had a chance to skip this entirely. Teams that treat the marketplace as a trusted channel are exactly who this was built for.