Review extension releases
Use approved extensions, validate release provenance and consider a waiting period for new versions.
What this does—and does not—establish
A trusted name cannot establish that a marketplace copy is authentic.
AI as a targetCASE STUDY / Cursor marketplace
A poisoned AI extension tried to leave a hidden doorway
Cursor reports altered Claude Code extensions distributed through its marketplace.
Source: CursorThe distribution window was about 2:27 a.m.–1:35 p.m. Pacific time. Earlier attacker access is undated.
THE 10-SECOND TAKEAWAY
Protect the tools around the AI.
HOW IT WORKED
Follow the chain.
Marketplace
→
Altered extension
→
Developer computer
SIMPLIFIED VIEW · 1 / 3STEP 01
A familiar tool is altered
Cursor’s marketplace distributed an extension carrying hidden malicious code.
CursorExtension starts
→
Hidden code
→
Access attempt
SIMPLIFIED VIEW · 2 / 3STEP 02
Ordinary startup activates it
Loading the extension triggered collection of computer details and attempts to establish remote access.
Microsoft Security ResearchStartup entry
→
Later restart
→
Access attempt
SIMPLIFIED VIEW · 3 / 3STEP 03
A restart may preserve the trap
Startup changes could keep it running. Errors and permission requirements could block remote access while leaving harmful files behind.
Microsoft Security ResearchMove through the story at your own pace.
1 / 3
THINK OF IT THIS WAY
Editorial analogy: a familiar delivery contains a spare door key planted by someone else. Taking back the delivery does not recover a spare key left behind.
An analogy for the mechanism; not an additional claim about the incident.KEEP THE EVIDENCE IN VIEW
What we know.
What we don’t.
Reported outcomes
Cursor identifies versions 2.1.312 and 2.1.313 for macOS and Windows. Cursor
Microsoft found code intended to enable persistent remote access. Microsoft Security Research
Important limits
Cursor says errors and missing administrator privileges blocked remote access on most Macs and Windows PCs. Total affected users and successful logins remain unknown.
AI tooling was targeted; AI assistance in creating the attack is unproven.
Microsoft says Anthropic’s systems, Visual Studio Marketplace and the official npm distribution were unaffected.
Collected setting names did not contain the secret values stored under those names.
The lesson beyond
this one case.
Editorial lesson: software around an AI assistant needs its own security checks. Investigate what an altered add-on changed, not just whether it is still installed.
Where were the people?
Someone altered the extension; attribution remains unknown. Cursor
What happened in response? +
Cursor says it removed the releases, rebuilt its marketplace and took the attacker’s server offline. Cursor
What could help
an organization?
Editorial defense mapping for organizations adopting coding assistants. It does not establish missing controls or guarantee prevention.
Limit workstation authority
Keep routine coding work separate from administrator access and sensitive credentials.
What this does—and does not—establish
Some malicious changes can occur without administrator rights.
Investigate beyond uninstalling
Check device activity, unauthorized access and startup changes; preserve evidence before cleanup.
What this does—and does not—establish
Removing an extension or disabling an attacker server does not establish that a device is clean.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkTRACE IT TO THE SOURCE
Read the evidence.
Explore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Claude Code extension security noticeCursor · Oct 29, 2026 · disclosure
02Analysis of a malicious Claude Code-branded extensionMicrosoft Security Research · Oct 30, 2026 · investigation
Read this case’s update history →
Reviewed Oct 31, 2026 · Editorial methodology · Structured data