A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices

A malicious Anthropic Claude Code extension for Windows, macOS, and Linux infiltrated the AI software-development platform Cursor's integrated development environment extension marketplace. This rogue extension, designed with a backdoor, was downloaded by “at most 5,000 users” for roughly 11 hours on Thursday before Cursor shut down the marketplace to investigate.

The malware's design allowed attackers to gain access to victim devices, potentially serving as a stepping stone to deeper control inside a target network. However, a flaw in the malware's design blocked it from fully establishing itself on the vast majority of targets. Calum Hall, cofounder and CEO of detection firm Phorion, who first spotted the malicious extension, commented on the fortunate turn of events, stating that it was "potentially a really dangerous foothold for an attacker".

The source of the malicious extension remains unclear. While some researchers initially speculated that it came from a compromised Anthropic system, Cursor denied this claim in its security alert, stating that these malicious versions were not developed by Anthropic. Anthropic's technical staff member Felix Rieseberg echoed this sentiment, explaining in a post on X that a malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension.

He added that Anthropic's official channels are not affected, and the incident did not involve a compromise of any Anthropic systems. Both Cursor and Anthropic have emphasized that their systems were not involved in the building, publishing, or hosting of the malware. However, Cursor has not provided WIRED with a comment regarding the incident or its potential causes.