The AI software-development platform **Cursor**, owned by **SpaceX**, recently faced a security scare when a malicious 'Claude Code' extension was discovered on its integrated development environment (IDE) extension marketplace. Available for Windows, macOS, and Linux, the extension carried a backdoor designed to grant attackers access to victim devices. ### The Discovery and Scope of Impact The rogue extension was live for roughly 11 hours last Thursday. **Cursor** estimates that "at most 5,000 users" downloaded the compromised extension. The company swiftly shut down its extension marketplace during the investigation, confirming that no other extensions were affected. ### A Flawed Backdoor and Fortunate Outcome Despite the potential severity, a design flaw in the malware proved to be a saving grace. This defect largely prevented the backdoor from fully establishing itself on the majority of targeted systems. **Calum Hall**, cofounder and CEO of detection firm **Phorion**, which first identified the malicious extension on a customer's Mac, emphasized the gravity of the near-miss: "Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker." **Cursor** has since published remediation steps for the approximately 5,000 affected users. ### Unanswered Questions Regarding Infiltration Crucially, the method by which the malicious extension infiltrated the **Cursor** marketplace remains unclear. Initial speculation pointed towards a compromise of **Anthropic's** systems, the creators of the legitimate **Claude Code**. However, **Cursor's** security alert explicitly stated, "these malicious versions of the extension were not developed by **Anthropic**." **Felix Rieseberg**, a member of **Anthropic's** technical staff, clarified on X (formerly Twitter) that "it wasn’t a compromise of **Anthropic’s** systems or employee laptops. A malicious actor used access to **Cursor’s** marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts **Cursor** users." **David Dworken**, also from **Anthropic's** security team, reiterated this, explaining that "this did not involve a compromise of any **Anthropic** systems… We were not involved with building, publishing, or hosting this." **Cursor** has not yet provided further details on how the malicious upload occurred or whether it stemmed from a breach within its own systems.