Cursor, an AI software-development platform owned by SpaceX, experienced a security incident involving a malicious Anthropic Claude Code extension available in its marketplace for about 11 hours. The extension was downloaded by up to 5,000 users before Cursor took action to shut down the marketplace and investigate the issue.
The compromised extension contained a backdoor intended for unauthorized access to user devices. Fortunately, a flaw in the malware's design prevented it from fully executing on most affected machines. Cursor has since provided remediation steps for users impacted by the incident.