Developers using the Cursor code editor were urged to check their machines this week after a tampered version of Anthropic’s popular Claude Code extension was discovered in the marketplace. The booby-trapped extension, live for about eleven hours, attempted to install an SSH backdoor on users’ computers, potentially reaching as many as 5,000 developers before it was pulled.
How the Claude Code Extension Attack Worked
According to Cursor and security researchers who examined the incident, two tampered versions of the extension appeared in the marketplace masquerading as the genuine Anthropic tool. Once installed, the malicious code tried to add an attacker-controlled SSH key, a classic persistence technique that would let intruders log into a victim’s machine remotely long after the extension was removed. Users were advised to look for a suspicious key named in the advisories.
The targets were well chosen. Developers’ machines hold source code, cloud credentials and production access tokens, making a single compromised laptop a doorway into an entire company. Supply-chain attacks through extensions, packages and model repositories have become a preferred route for sophisticated hacking groups precisely because the victims install the malware themselves.
A Pattern, Not an Isolated Case
The incident arrived in the same week that researchers flagged dozens of fake AI model repositories hijacking GPUs for crypto mining, and a separate critical flaw in a ubiquitous compression library landed on the US government’s exploited-vulnerabilities list. Together they describe an ecosystem whose openness, its greatest strength, is also its attack surface.
The parallels with consumer fraud are striking. As our report on phishing’s new face explained, deception scales because people trust familiar packaging, whether that is a bank’s logo in an email or a famous product’s name in an extension marketplace. Verification habits, not just better tools, are the missing defence in both worlds.
What Users Should Do
Cursor removed the malicious versions and published guidance, but the responsibility now sits with anyone who installed updates during the window. Security teams recommend auditing authorised SSH keys, rotating credentials stored on affected machines, and treating extension updates with the same suspicion as any software download. Marketplace operators, meanwhile, face pressure to verify publisher identities and sign packages cryptographically.
The affair will also fuel debate about AI coding tools themselves, which encourage rapid installation of extensions and agents with broad permissions. For a concise digest of the incident and the week’s other security stories, the daily AI news brief lays out the indicators of compromise and the response steps in one place.
The extension was live for eleven hours; the lesson will last much longer. As AI tools weave themselves into every developer’s workflow, the marketplaces that distribute them become critical infrastructure. This attack failed to hide for long, but it proved how much damage a familiar name and a few hours of exposure can threaten.
