AI security breach: malicious claude code extension exposes new risks

A malicious version of Anthropic’s Claude Code extension was available on Cursor’s VS Code marketplace for about 11 hours, exposing users to potential cyber threats. The compromised extension, designed to collect user data and install a persistent backdoor via SSH, was removed after Cursor discovered the breach. The company emphasized that the backdoor’s functionality was likely flawed, though it temporarily shut down and rebuilt its marketplace to ensure no other extensions were compromised. Cursor urged users who installed the affected version on October 29 to check for infections and change compromised credentials. The hackers’ identities remain unknown, but cybersecurity expert Eerke Boiten warned that the incident highlights growing risks as AI coding tools become more integrated into development workflows. Anthropic stated the breach only impacted Cursor users and was unrelated to its own systems.