Cursor

Summary

Attackers distributed a maliciously modified version of Anthropic's Claude Code extension through the marketplace of Cursor, an AI-powered software development platform. The compromised extension remained available for approximately 11 hours and attempted to install a persistent backdoor enabling unauthorized remote access to developers' computers. The company said as many as 5,000 users may have been affected and temporarily shut down its extension marketplace while removing the malicious package. The incident illustrated how reliance on AI coding assistants can create opportunities for attackers to distribute malware through trusted software, though the company has not established that AI itself was used to develop or execute the malicious extension.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 29, attackers distributed a maliciously modified version of Anthropic's Claude Code extension through the marketplace of Cursor, an AI-powered software development platform. The compromised extension remained available for approximately 11 hours. The malicious package attempted to install a persistent backdoor that could allow unauthorized remote access to developers' computers. Cursor stated that as many as 5,000 users may have been affected by the distribution of the tampered extension. The attack targeted a tool used by developers to interact with AI coding assistants. In response, Cursor temporarily shut down its extension marketplace while removing the malicious package. The company has not established that AI itself was used to develop or execute the malicious extension. This incident took place during a month in which multiple AI development platforms disclosed security incidents.

Cybersecurity company Wiz described the series of October incidents affecting AI platforms as "Black October" and noted that at least nine AI development platforms disclosed security incidents during the month. Several attacks targeted credentials that allowed users to access powerful AI models, potentially enabling criminals to use expensive computing resources without authorization, resell access, or extract information from the models. In some incidents, attackers were suspected of deploying autonomous AI agents capable of identifying vulnerabilities, exploiting systems, and expanding their access with limited human intervention. The attacks differed in their methods and objectives, and authorities have not established that they were part of a single coordinated campaign or that AI was used in every case. Other organizations affected during the period included cryptocurrency exchange Binance, which suffered an estimated $6.3 billion theft, and Japanese video game publisher Capcom, which reported unauthorized access affecting nearly 11.8 million customer records. The Cursor incident illustrated how software supply chains and extension marketplaces associated with AI development tools can be leveraged to reach developer environments. Cursor's containment actions included the removal of the malicious package and the temporary suspension of its extension marketplace. No evidence was publicly presented linking the Cursor incident to a broader coordinated campaign, and the precise role of any automated tools in the creation or deployment of the malicious extension remains unconfirmed by the company.

Sources

Sources available to members: 1 source.