Security researchers have revealed that a tampered version of a Claude Code extension reached as many as 5,000 users of the Cursor code editor through its marketplace. The rogue build, version 2.1.313, quietly installed persistent remote-access mechanisms on developers machines, in what researchers describe as a textbook supply-chain attack on the AI coding ecosystem.
How the Claude Code Extension Attack Worked
According to analysis published by StepSecurity, the payload was designed to survive removal of the extension itself, embedding itself so the attacker could return later. The targeting is significant: developers machines hold source code, cloud credentials and signing keys, making a single compromised workstation a doorway into an entire company.
Anthropic moved quickly to clarify that its own systems and official distribution channels were not compromised. The malicious package rode on a third-party marketplace listing rather than an official release. Developers are, as our our piece on the new legacy code audit profession has observed in another context, becoming custodians of an ever more complex toolchain, and attackers know it.
Why Developer Tools Are Prime Targets
AI coding assistants have spread through the industry at remarkable speed, and extensions for them inherit broad permissions: they read entire codebases, run terminal commands and handle authentication tokens. That combination makes a poisoned extension far more valuable than a poisoned consumer app.
As today AI news brief reports in its daily AI brief, the incident has prompted urgent calls for developers who installed the extension to rotate credentials and audit their machines, treating the event as a breach rather than a near miss.
Marketplace security is the weak seam of the whole AI tooling boom. Extensions are typically published by individuals, reviewed lightly if at all, and updated silently, which means a trusted tool can turn malicious overnight without any change in what the user sees. The incident will strengthen the case inside large companies for allow-lists of approved extensions, internal mirrors of marketplaces, and treating developer workstations with the same rigour long applied to production servers.
The Trust Problem for AI Tooling
The deeper damage is reputational. Every supply-chain incident makes security teams more reluctant to approve the AI tools that engineering teams want to use, slowing adoption of genuinely useful technology. Marketplaces will face pressure to add signing, review and provenance checks that the extension ecosystem has historically skipped.
For individual developers, the lessons are old ones in new clothes: install from official channels, pin versions, review permissions, and assume that anything running with your credentials is part of your attack surface.
No evidence has emerged that the attackers used their access for a major follow-on breach, but persistence mechanisms are built for patience. The full cost of this incident may only become clear in the months ahead, which is precisely why researchers are urging thorough clean-up now.
