Trojanized Claude Code Extension on Cursor Marketplace Exfiltrated System Data
Summary
A malicious Claude Code extension was available in Cursor's marketplace for 11 hours on Oct. 29. Cursor said up to 5,000 users may have been affected; the extension exfiltrated system information and attempted to establish persistent access.
Key points
- Cursor said a malicious version, 2.1.313, replaced the legitimate Claude Code extension in its marketplace for 11 hours on Oct. 29.
- Users who downloaded or updated the extension during that period may have received code that attempted to add an attacker-controlled SSH key and establish persistent access.
- The extension also sent system information, including hostnames, usernames, operating system details, environment variable names, Git email addresses and public IP addresses.
- Cursor said at most 5,000 users were affected. The attempted SSH persistence required administrative privileges that the extension would have only in highly unusual circumstances.
- Cursor rotated keys, checked other extensions for tampering, temporarily took its marketplace offline and rebuilt it. The initial intrusion method remains unknown.
- Separately, Forever Security researchers reported a non-universal exploit in Cursor's built-in browser that could bypass its safety sandbox and deploy an app in tests. Cursor reportedly patched that issue on Oct. 1.
Article Details
- Victim Organization
- Cursor
- Incident Type
- Compromise of the Cursor Marketplace that replaced the legitimate Claude Code extension with a trojanized version; the malicious extension exfiltrated system information and attempted to establish persistent access.
- Data Types Exposed
- Hostnames
- Usernames
- Operating systems
- Operating system architectures
- Home directory paths
- Environment variable names
- Working directories
- Configured Git email addresses
- Public IP addresses
- Affected Records
- Cursor stated that at most 5,000 users were affected.
- Affected Data Size
- Unknown
- Operational Impact
- The malicious extension was available for 11 hours on Oct. 29, from 9:27 a.m. GMT to 8:35 p.m. GMT, as version 2.1.313. It exfiltrated the listed system information and attempted to add an attacker-controlled SSH key and establish persistent access. Cursor said privileged access would have been possible only in a minority of cases and under highly unusual circumstances. Cursor rotated keys, checked other extensions for tampering, temporarily took its marketplace offline, rebuilt it, and worked with the hosting provider to take down the malicious infrastructure.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
MITRE ATT&CK
T1053.005 · Scheduled TaskThe malicious extension attempted to establish persistence on Windows using scheduled tasks.T1195.002 · Compromise Software Supply ChainThe legitimate Claude Code extension distributed through the Cursor Marketplace was replaced with a malicious version.T1543.001 · Launch AgentThe malicious extension attempted to establish persistence on macOS by registering a LaunchAgent.
People
Vendors
AnthropicAnthropic's official Claude Code extension for the Cursor VS Code Marketplace was hijacked and swapped out for a malicious version with a persistent backdoor.CursorAnthropic's official Claude Code extension for the Cursor VS Code Marketplace was hijacked and swapped out for a malicious version with a persistent backdoor.
Products
Claude CodeAnthropic's official Claude Code extension for the Cursor VS Code Marketplace was hijacked and swapped out for a malicious version with a persistent backdoor.CursorAnthropic's official Claude Code extension for the Cursor VS Code Marketplace was hijacked and swapped out for a malicious version with a persistent backdoor.