Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).
October 30, 2026
Anthropic's official Claude Code extension for the Cursor VS Code Marketplace was hijacked and swapped out for a malicious version with a persistent backdoor.
The SolarWinds -style attack in miniature lasted only 11 hours, from 9:27 a.m. GMT to 8:35 p.m. GMT, on Oct. 29, according to Cursor's disclosure. Any software developers who downloaded or updated Claude Code in their Cursor integrated development environment (IDE) during that time would have received a malicious version 2.1.313, which pilfered sensitive data from infected machines and, in a minority of cases, could have allowed attackers persistent, privileged access to users' systems.
Cursor stated that "at most 5,000 users were affected," and that they will be contacted about the incident directly.
Separately that same day, researchers described an unrelated exploit in Cursor, allowing attackers to deploy arbitrary code to developers' machines via Cursor's built-in browser.
Related: Anthropic-Themed Phishing Emails Bypass Top Security Tools
Cursor did not immediately respond to an inquiry from Dark Reading regarding both of these stories.
For some, the notion of a compromised "extension" might evoke browser extensions, which are so frequently vulnerable, suspicious, and outright malicious that cybersecurity news concerning them tends not to evoke much panic, even in extreme cases .
Extensions in coding environments are a different beast. "IDE extensions are scarier than browser extensions because, unlike browser extensions, they are designed to have the same level of permissions as their host," Gal Weizman, security researcher at Forever Security, tells Dark Reading. "They can run code, access the filesystem, fire network requests and more."
On Thursday, an attacker tried to leverage the power afforded by coding environment extensions by sneaking a 66-line loader on top of the real extension's legitimate code. According to an analysis from the community threat intelligence platform OpenSourceMalware , everything about the extension remained the same besides this lone edit to its extension.js file.
As soon as the extension loaded — without need for the user to establish a Claude conversation — the new file is revved up. It attempts to add an attacker-controlled key to victims' SSH configurations, with the goal of establishing reverse tunnels that act as a backdoor into the compromised systems.
The malicious extension also attempts to make those connections persistent by registering background processes — for macOS systems, a LaunchAgent; and for Windows, scheduled tasks running with system privileges, plus a fallback Startup script. This whole business was doomed from the start, Cursor wrote, since turning on the local SSH service requires administrative privileges, which the Claude Code extension only possesses in "highly unusual circumstances."
Related: 'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
Victims weren't totally out of the woods, though, as the malicious code also exfiltrated system information via separate Web requests. Stolen data was limited to hostnames, usernames, operating systems (OS), OS architectures, home directory paths, environment variable names, working directories, configured Git emails, and public IP addresses.
Cursor's public disclosure suggests that the security incident was its own, not Anthropic's. The malicious version "was not developed by Anthropic ," the SpaceX-owned company reported.
In response to the discovery, Cursor took a variety of steps to protect itself: rotating its keys, checking for tampering in other extensions, and taking its marketplace temporarily offline and rebuilding it. It also worked with the relevant cloud hosting provider to take down the attacker's malicious infrastructure.
Cursor did not specify how the intrusion occurred in the first place. While acknowledging that it's not yet known what happened here, Weizman explains, "Historically, the most common way extensions and plug-ins get hijacked is through theft of locally stored credentials that allow publishing new versions of these packages."
Related: 10 Software Security Practices Built for the Next 250 Years
"Enabling 2FA for publishing such extensions is an excellent way to significantly mitigate such risk in the future. Relying on an access token as the only gate for pushing such critical software significantly increases the risk of this happening," he says.
On the same day of the Anthropic Cursor attack, Weizman published separate research detailing weaknesses in the browsers built into top desktop AI assistants today, which could be exploited to devastating effect. His test cases included Claude Desktop, GitHub Copilot, Codex, VS Code, and Cursor. Cursor has arguably the worst issue of the bunch.
In his experiments, Weizman's team created a clean-looking website, with a visible HTML chip concealing a malicious shell command in its attributes. Then they opened up the site in a built-in Cursor browser. "When the command hit Cursor's safety sandbox and was blocked, the agent — on its own, with nothing in the page telling it to — switched the sandbox off and tried again. The control worked. The agent talked itself out of using it," Weizman wrote in the report.
The attack didn't work universally across all models. When it did work, the browser escape allowed the researchers to deploy an arbitrary app to their test victim's computer. And just like the malicious Claude Code extension, the app ran with the victim's full permissions. Cursor did not respond to Forever Security's disclosure, but the company quietly patched the issue on Oct. 1.
“ IDEs are becoming more agentic. They're being given agentic capabilities, which can introduce dangerous architecture. It can be very risky when things go wrong," Weizman says.
"Here we've had two examples of that: built-in browsers, and what happened with Claude Code, both of which impacted Cursor," he concludes. "And because of the rapid pace at which this is happening, security isn't necessarily keeping up."
Nate Nelson
Contributing Writer
Nate Nelson is a journalist and award-winning scriptwriter. In addition to Dark Reading he writes for Darknet Diaries, the most popular show in cybersecurity across all media.
He began his career as a freelancer, ghostwriting Forbes and CNBC op-eds for executives in tech and finance. Then he transitioned to journalism at Threatpost, where he covered cybersecurity news and trends. Throughout those years he co-created a cybersecurity podcast, Malicious Life, which in its day climbed into the Top 20 technology podcasts charts on Apple Podcasts and Spotify.
He holds degrees from New York University and Bard College. As a born and bred New Yorker, he enjoys a superiority complex, but is polite enough to keep it to himself.