Malicious Claude Extension Hit 5,000 Cursor Users in Supply Chain Attack

A malicious version of the Anthropic Claude Code extension was live in the Cursor marketplace for approximately 11 hours on Thursday, October 30, 2026, reaching as many as 5,000 developer machines before being removed. Cursor, an AI software-development platform owned by SpaceX, briefly shut down its extension marketplace while investigating the incident.

The tainted extension was designed with a backdoor intended to give attackers access to victim devices — a type of implant commonly used as a foothold for deeper intrusion into a target network. Cursor published remediation steps for affected users on Thursday. A flaw in the malware’s own code, however, prevented it from fully establishing itself on the majority of targeted machines.

“Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker,” said Calum Hall, cofounder and CEO of detection firm Phorion, which was the first to identify the malicious extension after spotting it on a customer’s Mac.

Both Cursor and Anthropic were clear that the attack did not originate from a compromise of Anthropic’s systems. Felix Rieseberg, a member of Anthropic’s technical staff, wrote on X that “a malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish.” David Dworken, who works on security at Anthropic, separately confirmed that Anthropic was “not involved with building, publishing, or hosting this.”

How the malicious extension was uploaded to the Cursor marketplace in the first place remains unanswered. Cursor did not respond to questions about whether the incident resulted from a breach of its own systems. The episode highlights the risks of supply chain attacks targeting developer tools, where a compromised extension could potentially serve as an entry point to thousands of professional environments.