Malicious Claude Code extension hit Cursor’s marketplace

Cursor users who recently installed a Claude Code extension have a security issue to check. According to Cursor, as reported by The Decoder, a tampered extension appeared in Cursor’s VS Code extension marketplace for about eleven hours and may have reached up to 5,000 users.

The incident matters because AI coding tools sit close to a developer’s local files, terminals, credentials and project workflows. Even when the AI model itself is not the problem, the extension layer around coding assistants can become a weak point for freelancers, agencies and small teams that install tools quickly to keep up with client work.

What Cursor says the extension tried to do

The malicious item was presented as a Claude Code extension for Cursor. Cursor says Anthropic was not involved in building it, an important distinction because the extension used the Claude name but was not described as an Anthropic-developed product.

Claude remains one of the better-known AI assistants used by developers and technical teams, but this case is about a marketplace extension rather than a claim about Anthropic’s own service. That makes it a supply-chain issue: users may trust a familiar AI brand name while the actual package comes from somewhere else.

According to Cursor, the extension attempted to gather basic machine and network information, including:

• hostname
• username
• operating system
• public IP address

Cursor also said the extension tried to establish remote access for the attacker. The company added that this likely would not have worked on most machines because it would require administrator privileges.

How Cursor responded

After finding the malicious extension, Cursor removed it from the marketplace. The company then took the full marketplace offline.

Cursor says it worked with providers to neutralize the malware and brought the marketplace back only after confirming there was no remaining risk. The company also said no other extensions were affected.

That sequence is significant for teams that rely on AI coding assistants during daily work. A marketplace shutdown can interrupt workflows, but it also limits the chance that more users will install a compromised extension while the provider investigates. For small businesses without a dedicated security team, the provider’s response is often the first line of defense.

What users and teams should check

If you installed a Claude Code extension in Cursor around the period described by the company, treat it as something to verify rather than ignore. The reported exposure window was short, but Cursor’s own estimate says as many as 5,000 users may have been affected.

Practical steps for developers and managers are straightforward: confirm which extension was installed, remove anything suspicious, and review machines where the extension was present. Teams should also make sure that extension installs are not treated as casual personal choices when work repositories, client code or business credentials are on the same device.

This is especially relevant for freelancers and agencies that move quickly between projects. A compromised coding extension does not need to exploit the AI model itself to create risk; it can target the local environment where code, config files and identity details live.

A warning for AI coding marketplaces

The Cursor incident fits a broader pattern around AI development tools: as assistants become central to coding work, attackers have more incentive to target the surrounding ecosystem. That includes plugins, editor extensions, package registries and connected services.

For users comparing AI coding environments such as Cursor and GitHub Copilot, security now has to be part of the buying decision, not just code quality or convenience. Our Cursor vs GitHub Copilot guide looks at the broader tool choice, but incidents like this underline a separate question: how much do you trust the extension supply chain around the assistant?

It also echoes other recent developer-security concerns, including the reported OpenCode breach involving exposed AI API keys. The common lesson is not to avoid AI coding tools altogether. It is to treat them like powerful software with access to sensitive systems, and to scrutinize add-ons with the same care you would apply to any dependency in production work.