Developers who installed a popular AI coding extension this week may have picked up more than they bargained for. Security researchers say a tampered copy of a Claude Code extension slipped into the Cursor marketplace and reached as many as 5,000 users before the problem was spotted, in one of the most worrying supply-chain incidents to hit AI coding tools so far.
What the Researchers Found
A StepSecurity analysis published on 30 October reported that version 2.1.313 of the extension had been altered and distributed through the marketplace used by Cursor, the AI-focused code editor. According to the researchers, the modified package quietly installed persistent remote-access mechanisms on affected machines, the kind of foothold that can survive restarts and give an attacker ongoing control. The incident was among the leading items in today’s AI news briefing, which urged anyone who installed the update to treat their system as potentially compromised and to check for signs of the rogue components.
Anthropic Says Its Own Channels Were Not Breached
Anthropic clarified that its own systems and official distribution channels were not compromised, pointing instead at the third-party route the extension travelled through. That distinction matters, because the same tooling is now embedded in daily workflows, from autocomplete to prompt caching with the Anthropic API, which many teams rely on to cut the cost of long coding sessions. When an unofficial copy of a trusted plugin is poisoned, the trust users place in the original brand is exactly what attackers exploit.
What Developers Should Do Now
The practical advice is unglamorous but effective: install extensions only from official sources, pin and verify versions before updating, and audit any machine that received the suspect build. Teams should rotate credentials that were accessible from affected workstations, review marketplace publishers with the same care they give to open-source dependencies, and watch for follow-up guidance from both Cursor and Anthropic as the investigation continues.
AI coding assistants are becoming part of the software supply chain itself, and this week showed that they inherit all of its risks. A few minutes spent checking where an extension really came from is cheap insurance against a very expensive cleanup.
