Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft
Source: The Decoder (opens in a new tab) · Matthias Bastian
Intel Summary
The Decoder reports that a tampered Claude Code extension remained live on Cursor's marketplace for roughly 11 hours, affecting up to 5,000 users. The malicious extension attempted to steal user data and establish remote access before Cursor temporarily took the marketplace offline to remediate the threat.
Why It Matters
Highlights software supply-chain vulnerabilities within AI developer tool ecosystems and IDE extension marketplaces. Security and IT teams supporting Cursor users must identify whether the malicious extension was installed to investigate possible credential theft or unauthorized workstation access.
Organizations & Entities
Related Intelligence
- DevelopmentNewAlso involving Claude Code
Malicious Claude Code extension discovered on Cursor marketplace
The Decoder reports that a tampered Claude Code extension remained live on Cursor's marketplace for roughly 11 hours, affecting up to 5,000 users. The malicious extension attempted to steal user data and establish remote access before Cursor temporarily took the marketplace offline to remediate the threat. Claims are as reported; this summary makes no determination about accuracy or significance.
- ReportAlso involving Claude Code
Shadowy AI Relay Disables OpenAI Codex, Claude Code Sandboxes
Dark Reading reports that an unidentified relay service is distributing AI coding tools, including OpenAI Codex and Claude Code, to mainland China and other unsupported regions. The proxy service reportedly operates with key built-in sandbox security controls disabled.
Dark Reading - ReportAlso involving Cursor
Devs Hit by Trojanized Claude Code Extension for Cursor
Dark Reading reports that developers using the Cursor AI coding platform were targeted by a trojanized Claude Code extension. The incident was one of two serious security issues affecting Cursor on the same day, underscoring emerging supply chain risks targeting AI-powered integrated development environments.
Dark Reading - DevelopmentNewAlso involving Claude Code
Hackers breach OpenCode and steal user API keys
Hackers breached the online platform of open-source AI coding tool OpenCode and stole user API keys, using them to rack up charges on external AI accounts. Claims are as reported; this summary makes no determination about accuracy or significance.