Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft

A malicious version of the Claude Code extension remained active on the Cursor marketplace for 11 hours, exposing up to 5,000 users to potential data theft and unauthorized remote access. Cursor responded by temporarily disabling the entire marketplace to address the supply-chain breach and verify the security of its platform. This incident highlights the growing risks of third-party extensions within AI coding environments, where compromised tools can gain direct access to sensitive developer environments and proprietary source code.