Malicious Claude Code extension hits 5,000 Cursor users
What's the story
SpaceX-owned coding platform Cursor has been hit by a major security incident. The company discovered a malicious extension, dubbed Claude Code, in its marketplace. The rogue software was not created by Anthropic and could have given an attacker access to user data and remote control of their systems. The incident affected at most 5,000 users.
Quick action
Cursor took down its extension marketplace
In response to the security breach, Cursor took down its extension marketplace on Friday. However, it was restored shortly after as the company worked with relevant providers to neutralize the malware.
The firm also confirmed that there is no further risk from this incident and has advised all customers to update their Claude Code extensions.
Threat assessment
Malicious Claude Code extension discovered on October 29
The malicious Claude Code extension was discovered on October 29. According to Cursor, the extension runs "malicious code" that tries to create a backdoor in a system.
Once installed, it can steal user information such as IP addresses, usernames, and operating systems.
The rogue software also adds an attacker-controlled SSH key for unauthorized remote access to machines.
All stolen data is sent back to the hacker every 60 seconds.
Marketplace review
Cursor rotated security keys to contain the breach
Cursor conducted a audit of its marketplace to find any other affected extensions but none were discovered.
Before restoring the marketplace, the company took several measures including rotating security keys and blocking the attacker's connection to the server hosting the malware.
This incident comes amid a string of cybersecurity breaches this month, including Binance's admission of a hack endangering $6.3 billion in assets.