Hackers hijacked a Claude Code extension, exposing yet another new AI security risk

Hackers exploited a Claude Code extension, potentially exposing a new AI security risk. The malicious version of Anthropic's Claude Code extension, designed to run within Cursor, remained available on Cursor's VS Code marketplace for about 11 hours. The extension aimed to gather information about users' computers and install a persistent backdoor, attempting to access victims' machines via SSH even after removal.

Cursor removed the compromised extension upon discovery, emphasizing that the attack was limited to Cursor users. However, the company urged those who installed the affected version to check their computers for signs of infection, remove unauthorized access, and consider changing potentially compromised credentials. The hackers' identities remain unknown, but this incident highlights the growing risk as AI coding tools become ingrained in developers' workflows.

Security experts warn that such tools could be exploited in hybrid warfare, given their potential to reproduce malware across systems. The broader concern extends beyond individual computers to sensitive systems, with cybersecurity experts emphasizing the need to address the increased attack surface posed by AI coding assistants and their associated tools.