Cursor Marketplace Breach Delivers Malicious Claude Extension to 5,000 Developers

Key points

• The malicious extension was live on the Cursor marketplace from 2:27 AM to 1:35 PM PDT on October 29, 2026.
• Up to 5,000 users were affected, with the malware attempting to install an SSH backdoor and collect host reconnaissance data.
• Coding flaws and permission restrictions prevented the backdoor from fully executing on most devices, particularly macOS and Windows.
• Anthropic confirmed its systems were not compromised, and the malicious package was not developed or published by Anthropic.
• Cursor removed the extension, shut down the marketplace temporarily, and published remediation steps for affected users.

Background

This incident follows a pattern of supply-chain attacks targeting developer tools and AI platforms. In September 2026, attackers exploited a WordPress path traversal flaw within hours of the patch release, highlighting the rapid exploitation of vulnerabilities in widely used software. Additionally, Anthropic's recent 'Cyber Mission' initiative, launched in October 2026, aimed to bolster global cybersecurity through AI-driven vulnerability scanning and critical infrastructure defense, underscoring the growing emphasis on securing AI and developer ecosystems against such threats.

How outlets are covering it

Ars Technica emphasized the supply-chain nature of the attack, noting that the malicious version was distributed through Anthropic's official account on Cursor, raising questions about how attackers gained access. WIRED highlighted the 'lucky break' in the malware's design, which prevented full compromise on most devices, and noted that Anthropic's technical staff clarified the incident did not involve a compromise of Anthropic's systems. Microsoft provided a detailed technical analysis of the attack chain, including the SSH backdoor mechanism, persistence artifacts, and mitigation guidance, while confirming that the malicious packages were not distributed through Microsoft's Visual Studio Marketplace or npm.

Why it matters

This incident underscores the risks of supply-chain attacks in the AI and developer tool ecosystem, where a single compromised extension can affect thousands of users. The potential exposure of cloud credentials and API tokens, even if the backdoor largely failed, highlights the need for robust security measures, including extension installation cooldowns and approved publisher restrictions. The incident also raises questions about the security of AI-assisted developer tools and the importance of rapid response and remediation in such cases.

What to watch

Developers who installed or updated the Anthropic Claude Code extension from Cursor between 5:27 AM ET and 4:35 PM ET on October 29 should consider themselves potentially affected and follow the remediation steps published by Cursor. Organizations should review endpoint and network telemetry, rotate credentials, and investigate any evidence of loader execution or backdoor installation. Microsoft and other security firms are expected to continue monitoring for related threats and providing updated detection and hunting guidance.