Cursor marketplace poisoning hit up to 5,000 users via fake Claude Code extension
EricBuess · x · 2026-10-30
Cursor confirmed a security incident: an attacker used access to Cursor's extension marketplace to publish a tampered copy of the Claude Code VS Code extension, affecting at most 5,000 users. Anthropic engineer Felix Rieseberg clarified it was not a compromise of Anthropic's systems and the malicious extension wasn't built or published by Anthropic. Cursor took the marketplace down, worked with providers to neutralize the malware, and has since reinstated it with cleanup instructions in a blog post.
More from coding & agent
- Meta's coding model Muse Ember goes live on OpenRouter for agent sub-task fan-out — alexandr_wang · 2026-11-10
- Meta's Muse Ember coding model is now available in OpenCode — alexandr_wang · 2026-11-10
- OpenRSI scales recursive self-improvement to SGLang-Omni, +7.6%–344% throughput via 14 merged PRs — ChengleiSi · 2026-11-10
- OpenCode cuts memory 41% and OpenClaw starts 3.1x faster with Bun AoT — steipete · 2026-11-10
- Vibe-coded ambient music DAW 'Ambient Town' in a week with Push support — kieranklaassen · 2026-11-10
- GR00T 2's WAM API lets reasoning agents steer robots by pointing in the camera view — yukez · 2026-11-10