AI development company Cursor, owned by SpaceX, recently took its extension marketplace offline following the discovery of a malicious version of Anthropic's Claude Code extension. The tampered software posed significant risks, potentially exposing users' personal information and granting hackers remote access to their systems.
Cursor confirmed that approximately 5,000 users had been affected by the security incident. In response, the company swiftly addressed the vulnerability, neutralizing the malware and reinstating the marketplace. Users are no longer facing an ongoing risk from this specific incident.
Incident Details and User Advisory
The security breach involved a modified version of the Claude Code VS Code extension, which was accessed through Cursor's integrated development environment (IDE) extension marketplace. Cursor clarified that this malicious version was not developed by Anthropic, the creators of Claude, and did not impact other extensions available on its marketplace or other SpaceX-related products like Grok Bot and Grok.
While the immediate threat has been contained, Cursor strongly advises all affected users to update to the latest version of Claude Code for VS Code (version 2.1.314) to ensure continued security and mitigate any potential residual impact. The company communicated these details via an X (formerly Twitter) post and provided further instructions in a blog post for users to identify and address the malicious package.
Cursor's Background and Response
Cursor, an AI startup, was acquired by SpaceX for an estimated $60 billion in August. This incident underscores the ongoing challenges in maintaining cybersecurity within rapidly evolving AI and software ecosystems. The company's prompt action to shut down its marketplace, neutralize the threat, and provide clear guidance to users demonstrates a commitment to user safety following the breach.
This is a developing story, and users are encouraged to stay informed through official Cursor channels for any further updates.