Anthropic Denies Breach as Cursor Marketplace Supply-Chain Attack Infects 5,000 Developers

Key points

• The malicious extension was live on the Cursor marketplace from 02:27 to 13:35 PT on October 29, 2026, affecting up to 5,000 users.
• The implant collected usernames, Git emails, and public IP addresses while attempting to open a reverse SSH tunnel.
• A flaw in the malware required admin rights on macOS and Windows, causing the backdoor to fail on the vast majority of infected devices.
• Anthropic stated the attack was not a compromise of its systems or employee laptops, but rather a malicious actor using access to Cursor’s marketplace.
• Cursor confirmed the malicious version was not built by Anthropic and that its official channels remain unaffected.
• Remediation requires manual threat hunting and script execution, as installing the latest extension version does not remove the persistence mechanism.

Background

This incident follows earlier concerns about the safety of autonomous AI coding tools, such as a September 2026 report where Anthropic’s Claude Code agent allegedly deleted 48,000 files in 103 seconds. The current supply-chain attack highlights growing risks in AI developer tool ecosystems, where third-party marketplaces can become vectors for targeted malware distribution.

How outlets are covering it

The Register and Wired both report that Anthropic denied any compromise of its own systems, with Felix Rieseberg and David Dworken stating the attack involved a tampered copy published via Cursor’s marketplace. The Register emphasizes the technical details of the malware’s failure due to permission requirements, while Wired highlights the 'lucky break' of the coding flaw and notes that Cursor did not disclose how the malicious upload occurred. Both sources agree that the incident affected up to 5,000 users and that Cursor removed the extension and published remediation steps. Neither source provides details on the identity of the malicious actor or the specific breach vector at Cursor.

Why it matters

This incident underscores the critical risk of supply-chain attacks in AI development tools, where a single compromised extension can impact thousands of developers. The failure of the backdoor due to a coding flaw was a fortunate exception, but the exposure of host data and the need for manual remediation highlight the persistent threat to developer environments. It also raises questions about the security of third-party marketplaces and the potential for targeted attacks on AI coding platforms.

What to watch

Developers who installed the malicious extension must follow Cursor’s remediation steps to remove the persistence mechanism and check for successful SSH tunnel creation. Cursor has rotated its keys and blocked connections to the attacker’s server, but the method by which the malicious package was uploaded remains unclear. Anthropic and Cursor are continuing to work together on the incident, but no further details on the breach vector have been disclosed.