New Delhi: AI-powered coding platform Cursor temporarily shut down its extension marketplace after discovering a malicious version of Anthropic’s Claude Code extension that could expose developers’ computers to unauthorised access. The security incident potentially affected up to 5,000 users who downloaded or received the modified extension through Cursor’s marketplace.

Cursor disclosed the incident on October 30, saying the malicious extension was not developed by Anthropic. The company removed the affected package, worked with relevant service providers to neutralise the malware and temporarily took its marketplace offline while investigating the incident.

The marketplace was subsequently restored after Cursor said it had addressed the immediate risk. The company has asked users to update Claude Code for VS Code to version 2.1.314 and review its security guidance if they may have installed the affected release.

The incident has raised concerns about software supply-chain security, particularly as developers increasingly rely on third-party extensions to add AI assistants and other tools to their coding environments.

Malicious extension affected up to 5,000 users

According to Cursor, the security incident involved a modified version of the Claude Code extension distributed through its integrated VS Code extension marketplace.

The company said the incident affected at most 5,000 users. This is the maximum number of potentially impacted users disclosed by Cursor and does not mean that all 5,000 devices were successfully compromised.

The malicious package was made available on October 29. Microsoft’s security researchers identified the affected extension versions as 2.1.312 and 2.1.313. The malicious release was available through Cursor’s marketplace for several hours.

Microsoft’s investigation found that the modified package was distributed through Cursor’s marketplace and was not published through Microsoft’s official Visual Studio Marketplace or the npm package registry used for Anthropic’s Claude Code distribution.

Anthropic also confirmed that its systems and employee devices were not compromised and that it had neither developed nor published the malicious package.

The distinction is important because the incident involved a tampered copy of an extension carrying Anthropic’s name rather than a compromise of the company’s official software distribution channels.

How the malicious Claude Code extension worked

The affected extension was designed to execute malicious JavaScript code when it loaded inside the coding environment.

According to Microsoft’s security analysis, the injected code attempted to collect information about the affected computer, including the username, hostname, operating system and public IP address.

It also attempted to install an attacker-controlled SSH key and enable remote access to the machine. Secure Shell (SSH) is a technology commonly used by developers and system administrators to access computers remotely.

If successfully installed and configured, an unauthorised SSH key could allow an attacker to connect to a victim’s computer without permission.

The malicious code also attempted to establish a reverse SSH connection, enabling communication between the affected device and an attacker-controlled server. It included mechanisms intended to maintain access even after the initial extension activity.

Microsoft’s analysis found that the malware attempted to create startup mechanisms on Windows, macOS and Linux systems. These mechanisms were designed to help the malicious scripts run again after a user logged in or restarted the computer.

The code also attempted to transmit collected system information to a remote server at regular intervals.

However, the presence of these capabilities does not establish that every malicious action succeeded. Microsoft noted that successful remote access depended on factors such as administrator permissions, SSH configuration and the attacker’s server setup.

Security flaw may have limited the damage

Although the malicious extension was designed to establish a backdoor, researchers found that a flaw in its operation may have prevented it from fully compromising many of the targeted computers.

WIRED reported that a weakness in the malware’s design limited its ability to establish persistent access on the majority of affected systems.

Microsoft also noted that certain actions, including enabling SSH access, could fail because they required privileges that were not available on many machines.

This does not mean that users who installed the extension can automatically consider their devices safe. Even if the remote-access mechanism failed, the malicious code could still attempt to collect information and create files or other persistence mechanisms.

Cybersecurity researchers have therefore advised affected users to investigate their systems rather than relying only on installing a clean version of the extension.

The incident illustrates how a malicious software package can create a security risk even when it does not successfully complete every stage of an attack.

Cursor takes down and restores its marketplace

After identifying the malicious extension, Cursor temporarily shut down its extension marketplace on October 30.

The company said it worked with relevant providers to neutralise the malware and took steps to prevent further distribution.

Before restoring the marketplace, Cursor audited the available extensions and said it found no other affected extensions. It also rotated security keys and blocked the attacker’s connection to the server hosting the malicious software.

Cursor subsequently confirmed that the marketplace had been reinstated and that there was no continuing risk from the incident through the marketplace.

The company also clarified that other extensions downloaded from its marketplace were not affected. Its statement specifically said that the incident did not impact other SpaceXSI products, including Grok and Grok Bot.

However, the company has not publicly explained in detail how the malicious package was uploaded to its marketplace under Anthropic’s extension identity. The route through which the attacker obtained the ability to publish the modified package remains an important unanswered question.

What affected users should do

Cursor has asked customers to update Claude Code for VS Code to version 2.1.314.

However, simply updating the extension may not be sufficient for a computer on which the malicious code has already executed. The malware was designed to write files and configuration entries outside the extension’s installation directory.

Users who installed or automatically received the affected versions through Cursor’s marketplace during the exposure period should follow the company’s security instructions.

Microsoft’s security researchers have outlined several checks and remediation measures:

  • Check SSH authorisation files: Users should inspect relevant SSH authorised-key files for an unfamiliar entry associated with the attacker-controlled key.
  • Look for suspicious startup files: The malware attempted to create scripts and startup configurations that could maintain access after a restart.
  • Review system activity: Developers and organisations should examine SSH connections, unfamiliar processes, network traffic and unexpected file changes.
  • Remove confirmed malicious artefacts: Updating the extension does not automatically remove files or keys that may have been installed elsewhere on the computer.
  • Secure accounts and credentials: Where an investigation indicates possible exposure, users should rotate affected credentials and revoke active sessions from a trusted device.

Organisations should preserve relevant system evidence before cleaning affected machines. If a device shows signs of compromise, security teams may need to isolate it and consider rebuilding the environment from a known-clean backup.

Users should refer to Cursor’s official security notice and Microsoft’s technical guidance rather than deleting system files or SSH entries without verifying them.

What the incident means for AI coding tools

The security incident highlights the risks associated with third-party extensions in modern software development environments.

AI coding assistants are increasingly integrated into code editors, allowing developers to generate code, debug applications and automate routine tasks. Extensions make these tools easier to access, but they also introduce additional software components that must be verified and maintained.

A malicious update distributed through an extension marketplace can potentially affect developers who trust the marketplace as a source of legitimate software.

The incident also demonstrates why developers should pay attention to publisher identities, extension versions and security announcements. Organisations can reduce exposure by restricting installations to approved publishers, reviewing extension permissions and introducing checks before newly released versions are deployed widely.

For Cursor, the immediate marketplace issue has been addressed and the service restored. However, the incident leaves broader questions about marketplace security and how malicious software was able to appear under the identity of a recognised developer tool.

As AI-powered coding platforms become more widely used, securing their extension ecosystems will be an important part of protecting developers, their devices and the software projects they work on.