conv.

← The whole story
Security

Part of AI Developer Tools Security Crisis · 2 stories · since Oct 28 · newest 8d ago

Fake Claude Code Extension on Cursor Marketplace Backdoored Up to 5,000 Developers

Cursor says incident hit at most 5,000 users, not Anthropic's code

3 Oct 30 3:46 AM · 12d ago · 1 post · 1 source · development 3 of 8

Cursor's official account states the malicious version was accessed through its marketplace, was not developed by Anthropic, and did not affect other extensions.

Cursor says incident hit at most 5,000 users, not Anthropic's code
arstechnica.com

“We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users.”

@cursor_ai

Anthropic Maker of Claude CodeCursor (Anysphere) Operator of the compromised extension marketplaceMichael Truell Cursor CEO (@mntruell)Phorion Security research firm that discovered the backdoorKevin Beaumont (GossiTheDog) Security researcher

The whole story articlespostscomments the bright band is this development · numbered dots are the others · click one to jump

Peak 65 pieces in 4h at Oct 30, 5 AM; 231 pieces over 14 days (52 articles · 85 posts · 94 comments) Oct 28, 1 PM — 1 piece · 1 post — Mastodon 1Oct 28, 5 PM — quietOct 28, 9 PM — quietOct 29, 1 AM — quietOct 29, 5 AM — quietOct 29, 9 AM — quietOct 29, 1 PM — quietOct 29, 5 PM — quietOct 29, 9 PM — 2 pieces · 2 posts — Hacker News 1, X 1Oct 30, 1 AM — 27 pieces · 15 articles · 12 posts — Google News 12, Mastodon 8, Newswires 3, +2 moreOct 30, 5 AM — 65 pieces · 8 articles · 23 posts · 34 comments — Hacker News 28, Mastodon 20, Lobsters 10, +2 moreOct 30, 9 AM — 55 pieces · 1 article · 15 posts · 39 comments — Lobsters 21, Hacker News 19, Mastodon 11, +2 moreOct 30, 1 PM — 25 pieces · 5 articles · 8 posts · 12 comments — Mastodon 8, Lobsters 7, Hacker News 6, +2 moreOct 30, 5 PM — 7 pieces · 2 articles · 2 posts · 3 comments — Mastodon 2, Hacker News 2, Google News 1, +2 moreOct 30, 9 PM — 19 pieces · 14 articles · 3 posts · 2 comments — Newswires 14, Lobsters 1, Mastodon 1, +3 moreOct 31, 1 AM — 5 pieces · 1 article · 2 posts · 2 comments — Hacker News 2, Reddit 1, X 1, +1 moreOct 31, 5 AM — 2 pieces · 2 posts — Mastodon 2Oct 31, 9 AM — 1 piece · 1 article — Google News 1Oct 31, 1 PM — 2 pieces · 2 posts — Mastodon 2Oct 31, 5 PM — 2 pieces · 2 posts — Bluesky 2Oct 31, 9 PM — 2 pieces · 2 posts — Bluesky 1, Mastodon 1Nov 1, 1 AM — 4 pieces · 1 article · 1 post · 2 comments — Lobsters 2, Google News 1, Mastodon 1Nov 1, 4 AM — 2 pieces · 2 posts — Bluesky 2Nov 1, 8 AM — quietNov 1, 12 PM — 2 pieces · 2 articles — Google News 1, Mastodon 1Nov 1, 4 PM — quietNov 1, 8 PM — 2 pieces · 2 posts — Hacker News 1, Mastodon 1Nov 2, 12 AM — 1 piece · 1 post — Mastodon 1Nov 2, 4 AM — 2 pieces · 2 articles — Google News 1, Newswires 1Nov 2, 8 AM — 1 piece · 1 post — Bluesky 1Nov 2, 12 PM — quietNov 2, 4 PM — quietNov 2, 8 PM — 1 piece · 1 post — Bluesky 1Nov 3, 12 AM — quietNov 3, 4 AM — quietNov 3, 8 AM — quietNov 3, 12 PM — quietNov 3, 4 PM — quietNov 3, 8 PM — quietNov 4, 12 AM — 1 piece · 1 post — Mastodon 1Nov 4, 4 AM — quietNov 4, 8 AM — quietNov 4, 12 PM — quietNov 4, 4 PM — quietNov 4, 8 PM — quietNov 5, 12 AM — quietNov 5, 4 AM — quietNov 5, 8 AM — quietNov 5, 12 PM — quietNov 5, 4 PM — quietNov 5, 8 PM — quietNov 6, 12 AM — quietNov 6, 4 AM — quietNov 6, 8 AM — quietNov 6, 12 PM — quietNov 6, 4 PM — quietNov 6, 8 PM — quietNov 7, 12 AM — quietNov 7, 4 AM — quietNov 7, 8 AM — quietNov 7, 12 PM — quietNov 7, 4 PM — quietNov 7, 8 PM — quietNov 8, 12 AM — quietNov 8, 4 AM — quietNov 8, 8 AM — quietNov 8, 12 PM — quietNov 8, 4 PM — quietNov 8, 8 PM — quietNov 9, 12 AM — quietNov 9, 4 AM — quietNov 9, 8 AM — quietNov 9, 12 PM — quietNov 9, 4 PM — quietNov 9, 8 PM — quietYesterday, 12 AM — quietYesterday, 4 AM — quietYesterday, 8 AM — quietYesterday, 12 PM — quietYesterday, 4 PM — quietYesterday, 8 PM — quietToday, 12 AM — quietToday, 4 AM — quietToday, 8 AM — quietToday, 12 PM — quietToday, 4 PM — quietToday, 8 PM — quiet 12–78
1Malicious extension circulates on…2–7Cursor says incident hit at most 5,000…8Microsoft publishes technical postmortem…
Oct 29Oct 31Nov 2Nov 4Nov 6Nov 8now · 10:23 PM ET

What was reported 2 claims about this development

  1. 10 outlets Cursor flags malicious Claude Code extension, up to 5,000 users affected

    first by Business Today, 11d ago · also Digit, The Decoder, Reuters, Business Standard, Channel News Asia, Elets CIO +3

    8 more headlines
  2. 1 outlet Devs Hit by Trojanized Claude Code Extension for Cursor

    first by Dark Reading, 12d ago

What people said 1 voice · verbatim

All 8 developments of Fake Claude Code Extension on Cursor Marketplace Backdoored… →

MastodonHacker NewsNewswiresLobstersXGoogle NewsRedditBluesky