Up to 5,000 individuals affected by Claude Code extension hack
Cursor, the coding-tool company owned by SpaceX, announced on Friday that a maliciously altered version of Anthropic’s Claude Code extension was accessible on its Cursor VS Code extension marketplace on Thursday, impacting as many as 5,000 users. Cursor indicated that the extension was not created by Anthropic, and the maliciously altered extension was available on the marketplace from approximately 2:27 a.m. to 1:35 p.m. on Thursday.
The extension sought to gather host and user information, including hostname, username, operating system, and public IP address. It also sought to establish remote access for the attacker; Cursor indicated that a crucial step would have faltered on the majority of machines due to its requirement for administrator rights.
Upon detection, Cursor removed the malicious version, blocked its distribution, and shut down the marketplace as a precautionary measure. The company subsequently reconstructed the marketplace and reinstated it online, it stated. Cursor stated that the incident did not affect other extensions available on its marketplace.
