A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices

Malicious code in popular AI development tools can now steal your data or take control of your computer.

A malicious Anthropic Claude Code extension, downloaded by up to 5,000 users, was live on the Cursor AI development platform's extension marketplace for approximately 11 hours on Thursday. This extension, available for Windows, macOS, and Linux, contained a backdoor designed to grant attackers access to victim devices. Cursor, owned by SpaceX, briefly suspended its marketplace to investigate and has since published remediation steps. Researchers from Phorion discovered the malicious extension, noting a flaw in its design prevented full compromise on most targets. Both Cursor and Anthropic have stated that Anthropic's systems were not compromised, and the malicious extension was not developed or published by Anthropic, but rather by a third party who tampered with the extension and uploaded it to Cursor's marketplace. The method by which the attacker gained access to publish on Cursor's marketplace remains unclear.

This supply chain attack highlights a critical vulnerability in the burgeoning AI tool ecosystem: the trust placed in third-party extensions and marketplaces. Even established platforms like Cursor, backed by SpaceX, can become vectors for malware, demonstrating that code integrated into AI development workflows is as susceptible to compromise as traditional software. The incident underscores the need for rigorous vetting processes for AI extensions, as a single compromised tool can expose thousands of users and their sensitive development environments.

The attackers' success in publishing a tampered extension on Cursor's marketplace, coupled with the unclear entry vector, signals an evolving threat landscape where malicious actors are targeting the integration points of AI tools. This incident raises concerns about the security of AI-powered development environments and suggests that vulnerabilities in the marketplaces themselves, rather than the AI models, may become a primary focus for cybercriminals. Developers and platform providers must now prioritize securing these extension ecosystems to prevent future breaches.