Cursor says up to 5,000 users affected by tampered Claude Code extension
The extension attempted to collect host and user information such as hostname, username, operating system and public IP address
 "Cursor says up to 5,000 users affected by tampered Claude Code extension")
Cursor, the coding-tool company owned by SpaceX, said on Friday that a maliciously modified version of Anthropic's Claude Code extension was available on its Cursor VS Code extension marketplace on Thursday, affecting up to 5,000 users.
Cursor said the extension was not developed by Anthropic and the maliciously modified extension was live on the marketplace from about 2:27 a.m. PT to 1:35 p.m. PT on Thursday.
The extension attempted to collect host and user information such as hostname, username, operating system and public IP address.
It also attempted to set up remote access for the attacker; Cursor said a key step would have failed on most machines because it requires administrator rights.
Upon detection, Cursor removed the malicious version and blocked its distribution and shut down the marketplace as a precaution.
The company then rebuilt the marketplace and brought it back online, it said.
Cursor said the incident did not impact other extensions on its marketplace.
Anthropic did not immediately respond to a request for comment.
(Only the headline and picture of this report may have been reworked by the Business Standard staff; the rest of the content is auto-generated from a syndicated feed.)
Connect with us on WhatsApp