Official Claude Code extension on Cursor was backdoored
Claude Code is Anthropic's AI coding assistant. Many developers use it inside Cursor, a popular AI code editor, through an official extension. Security researchers found that this official extension, on Cursor's marketplace, had been backdoored. A backdoor is hidden code that gives attackers a secret way into your computer.
Ars Technica says the bad version stayed online for nearly 12 hours. It is still unknown how the attackers got into Anthropic's verified Cursor account. The security blog DoublePulsar describes it as a remote access trojan, a tool that lets attackers control a computer from far away. It was the top story on Hacker News, with three threads at 893, 655 and 399 points.
We still do not know how many people installed it, or what the attackers took. If you use Claude Code in Cursor, read the official advisories now. If you updated in that window, treat the machine as exposed and change your passwords and keys.
Developer laptops often hold the keys to company systems. Here, the danger came from a verified, official tool, not a shady download. On Monday, we saw agents hijacked by a simple text file; now the supply chain itself is the weak point.
