Cursor pulls malicious Claude Code extension

This is a serious supply-chain warning for AI coding workflows: editor extensions run with enough local access to turn a trusted marketplace into a direct path to developer infrastructure.

• –The payload collected host details, added an attacker-controlled SSH key, and attempted reverse tunneling.
• –Cursor said the malicious package was available for roughly eleven hours and may have affected up to 5,000 users.
• –The incident highlights why extension provenance and marketplace isolation matter as AI coding agents gain filesystem and shell access.
• –Developers should verify installed versions, inspect persistence mechanisms, rotate credentials, and treat unverified extension updates as executable code.