Tampered Claude Code extension in Cursor's marketplace shows AI tools are only as safe as the stores that distribute them

A tampered copy of Anthropic's Claude Code extension was available for about 11 hours on Thursday in the extension marketplace of Cursor, an AI coding platform owned by SpaceX. It was offered for Windows, macOS and Linux. Cursor says it was downloaded by "at most 5,000 users." The extension carried a backdoor, meaning hidden code that gives an attacker remote access to the machine. Cursor briefly shut down its marketplace while it investigated. It says no other extensions were affected, and it has published remediation steps for the users who installed the fake.

This was a supply chain attack: instead of breaking into victims directly, the attacker poisons a trusted source that victims install from. Phorion, a detection firm, was the first to spot it, after the extension turned up on a customer's Mac. Calum Hall, Phorion's cofounder and CEO, told WIRED that "everyone was so lucky here." A design flaw in the malware stopped it from fully installing itself on the vast majority of affected devices. Hall still called it "a really dangerous foothold" for an attacker. That matters because a backdoor on a developer's laptop is usually a first step toward deeper access to a company's network.

The key question is still unanswered: how did the tampered extension get into Cursor's marketplace? Some researchers first suspected a compromise at Anthropic. Both companies reject that. Cursor's security alert says the malicious versions "were not developed by Anthropic." Felix Rieseberg, a member of Anthropic's technical staff, said on X that a malicious actor "used access to Cursor's marketplace" to publish a modified copy. He added that Anthropic's official channels are not affected. David Dworken, who works on security at Anthropic, said the company was not involved in building, publishing or hosting it. Cursor did not answer WIRED's questions about how the upload happened or whether it came from a breach of its own systems. Until it does, no one should assign blame.

**Our read.** Our thesis is that in agentic software development, the most valuable target is the distribution chain, not the model. A coding extension like Claude Code runs on the developer's own machine. It can read the codebase, run commands and touch credentials. That makes it an ideal disguise for a backdoor. The attacker did not need to fool an AI model. They only needed to get into the place where developers install tools, and to borrow the name of a brand those developers trust. We have argued before that the fight between AI companies is moving to distribution and integration, and that whoever controls that layer wins. This incident shows the other side of that argument: whoever controls distribution is also responsible for securing it.

This fits a pattern we have been tracking. AI makes attacks cheaper and faster, and developers, who hold the keys to production systems, are a high-value target. The lesson is not that AI coding assistants are dangerous. The lesson is that their marketplaces need the same controls already expected of mature software repositories: verified publishers, cryptographic signatures that tie each package to its real author, review before publication, and detection that can catch a fake in hours, not weeks. The response was reasonably fast here: about 11 hours exposed, the store shut down, and remediation steps published. But protection came partly from the attacker's own mistake, and luck is not a security strategy.

In the short term, every company using third-party IDE extensions (plugins for the code-editing environments developers work in) should review what it has installed and where it came from. In the longer term, we remain optimistic about AI-assisted programming, which promises to multiply what small teams can build. That promise depends on trust, and trust depends on how secure these distribution channels are. If AI tools are going to work on our behalf on our own machines, the marketplaces that deliver them need to be secured as critical infrastructure.