Cursor finds a trojanized Claude Code extension exposing up to 5,000 users
As seen on the 24/7 Wall St. homepage on October 30, 2026.
AI coding tools just inherited the app-store supply-chain problem, with up to 5,000 developer machines exposed through a single poisoned extension. Enterprise security budgets follow incidents like this one.
BREAKING: Cursor discovers a malicious version of Claude Code in its marketplace that attempts to give hackers remote access to users' computers, potentially affecting up to 5,000 users.
- Replies21
- Reposts4
- Likes61
Continue ReadingShow less
A malicious version of Claude Code appeared in Cursor's marketplace and was built to hand hackers remote access to the machines of developers who installed it. Cursor discovered the poisoned extension and disclosed the incident, with the potential exposure reaching up to 5,000 users.
This is a textbook supply-chain attack, the kind that has repeatedly hit traditional software repositories, now landing inside AI coding tools. Developers trusting the Cursor marketplace as a curated source had no reason to treat a Claude Code listing with suspicion.
Sponsored
The incident signals that the app-store security model these platforms inherited from mobile ecosystems has not kept pace with adoption. Enterprise security and compliance teams will now vet AI coding extensions the way they already vet browser plugins and CI/CD integrations.
Incidents like this accelerate spending on software supply-chain security tooling and push platform vendors toward mandatory code-signing and stricter extension review. The exposure is large enough to draw regulatory attention from other AI marketplace operators.