A tampered Claude Code extension on Cursor's marketplace shows AI coding tools are now a supply-chain target

A malicious version of Anthropic's Claude Code extension, built for Windows, macOS and Linux, was live for roughly 11 hours on Thursday in the extension marketplace of Cursor, the AI coding platform owned by SpaceX. Cursor says it was downloaded by "at most 5,000 users." According to WIRED, the extension contained a backdoor that gave attackers access to victims' machines. Attackers typically use that kind of implant as a first step toward deeper control of a network. Cursor briefly shut down its marketplace to investigate, said no other extensions were affected, and published remediation steps for the affected users.

The saving grace was a mistake by the attacker. A flaw in the malware's design stopped it from fully installing itself on the vast majority of targets. "Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker," Calum Hall told WIRED. Hall is cofounder and CEO of the detection firm Phorion, whose researchers first spotted the extension on a customer's Mac.

Nobody has yet explained how the extension got into the marketplace. Some researchers first suspected a breach at Anthropic. Cursor's own security alert said the malicious versions "were not developed by Anthropic." Anthropic's Felix Rieseberg posted on X that a malicious actor "used access to Cursor's marketplace to publish a tampered copy," and that Anthropic's official channels were not affected. Anthropic security staffer David Dworken said the company was not involved in building, publishing or hosting it. According to WIRED, Cursor did not respond to questions about whether the upload came from a breach on its side. That leaves the key question open, and we won't assign blame the evidence doesn't yet support.

Our thesis: AI coding tools have become prime targets for supply-chain attacks, where hackers compromise software at its distribution point instead of attacking users one by one. The appeal is obvious. A coding-agent extension runs on developers' own machines, usually with broad file and terminal access, and developers often hold keys to production systems and source code. Compromising one trusted extension in one marketplace reached up to 5,000 of those machines in half a day. The attacker did not need to beat Anthropic's security. They needed only a gap somewhere in the chain between the model maker and the user. As agents gain more autonomy, the place they are installed from becomes as important as the model itself.

Our reading: this matches a thread we have been following. Interoperability between agents is becoming a shared commons, and the real competition is shifting to identity, permissions and provenance. This incident shows why. Signed releases, publisher verification and a clear record of who uploaded what are not bureaucratic extras. They are the foundation that agentic development rests on. Short term, expect a messy period in which IDE (integrated development environment) marketplaces get attacked the way npm and browser extension stores were before them. Longer term, we're cautiously optimistic: incidents like this tend to force the industry to standardize trust infrastructure, as happened with package signing. The lesson is to fix provenance now, while the damage was limited by an attacker's bug and not by anyone's defenses.