A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices

A malicious Anthropic Claude Code extension was live in Cursor's IDE extension marketplace for roughly 11 hours on Thursday and downloaded by "at most 5,000 users," Cursor said in a Thursday security alert. The tainted extension carried a backdoor designed to give attackers access to victim devices, and Cursor briefly shut down the marketplace while it investigated; a design flaw in the malware blocked it from fully establishing itself on most targets. Anthropic technical staff member Felix Rieseberg said the incident "wasn't a compromise of Anthropic's systems or employee laptops," and Cursor said the malicious versions "were not developed by Anthropic," leaving unclear how the upload reached the marketplace.

The AI software-development platform Cursor, which is owned by SpaceX https://www.wired.com/tag/spacex/ , had a malicious Anthropic Claude Code https://www.wired.com/story/claude-code-success-anthropic-business-model/ extension for Windows, macOS, and Linux live in its integrated development environment extension marketplace for roughly 11 hours on Thursday. The company says the rogue extension was downloaded by “at most 5,000 users.” Cursor briefly shut down the extension marketplace while it investigated the situation, which the company says did not impact any other extensions. The tainted extension was designed with a backdoor to give attackers access to victim devices—the type of implant that malicious hackers often use as a stepping stone to deeper control inside a target network. Cursor published https://cursor.com/blog/claude-code-extension-security-notice remediation steps on Thursday for the roughly 5,000 affected targets. A saving grace of the situation, though, was a flaw in the malware's design that blocked it from fully establishing itself on the vast majority of targets. “Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker,” says Calum Hall, cofounder and CEO of the detection firm Phorion, the first researchers to spot https://phorion.io/blog/offical-claude-code-vsx-compromise/ the malicious extension after detecting it on a customer's Mac. What is still unclear is how the malicious extension made its way into the Cursor marketplace at all. Some researchers initially speculated that it came from a compromised Anthropic system. But Cursor said in its Thursday security alert that “these malicious versions of the extension were not developed by Anthropic.” Felix Rieseberg, a member of Anthropic's technical staff, posted https://x.com/felixrieseberg/status/2116170451466543578?s=20 on X on Friday: “We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.” David Dworken, who works on security at Anthropic, posted https://x.com/ddworken/status/2116178850032066572?s=20 on X shortly after, explaining that “this did not involve a compromise of any Anthropic systems … We were not involved with building, publishing, or hosting this.” Cursor did not return WIRED's request for comment about how the malicious upload happened and whether it was the result of a breach at Cursor.