Cursor Reports Malicious Claude Code Extension Affecting Approximately 5,000 Users
The AI coding platform Cursor has identified a security breach involving a malicious version of the Claude Code extension on its marketplace. The tampered extension was active between 5:27 AM and 4:35 PM ET on Thursday, potentially affecting up to 5,000 users. The malicious code was designed to harvest sensitive system information, including hostnames, usernames, operating systems, home directory paths, and public IP addresses. Cursor has since removed the compromised extension from its marketplace and confirmed that no other extensions were affected by this specific tampering incident.