A malicious extension impersonating Claude Code targeted developers using the Cursor marketplace, attempting to open a persistent backdoor on compromised systems. The incident shows how developer tools can become a supply chain route to source code, credentials and production access.
The extension used a trusted-looking name and presentation to encourage installation. Its payload tried to establish remote access and persistence, although the attack failed on many systems because it lacked administrator privileges.
Removing the extension may not eliminate every artifact left by the payload. Security teams should treat an installation as a potential endpoint compromise, not simply a bad plugin that can be uninstalled.
Bri Frost, Director of Product Management at Cloud Range, said:
The most useful lesson here is what stopped the attack. The malicious extension tried to open a backdoor, and on most machines that step failed because it didn’t have admin rights. As developers bring more AI tools into their workflow, permissions are doing more of the security work than many teams realize. These tools get installed quickly, trusted by default and often sit close to source code, credentials and production access. Organizations should know exactly what each AI tool on a developer endpoint can access and change, and limit that to what the job requires. They also need a response plan that doesn’t stop at removal. Cursor notes that uninstalling may not be enough because the payload leaves persistence behind. Teams should practice tracing what a compromised tool touched, isolating affected hosts and deciding when to rebuild rather than clean.
Enterprises should restrict extension installation, enforce least privilege on developer endpoints and review affected hosts for persistence, credential theft and unauthorized code access.