Security Researchers Uncover Malicious Claude Extension in Cursor Supply Chain Breach

Security researchers have identified a compromised extension for the Claude AI model that was distributed through the Cursor development environment, marking a notable supply‑chain intrusion. The malicious code was discovered performing host‑level reconnaissance and attempting to establish a reverse SSH tunnel, which could allow attackers to gain persistent access to affected machines.

The investigation, first reported by SecurityWeek, revealed that the extension, once installed, silently queried system information such as operating system details, network configuration, and running processes. This data collection appears to be a preliminary step, enabling the threat actors to map the target environment before proceeding with further exploitation.

In addition to reconnaissance, the payload tried to open a reverse SSH connection to an external server controlled by the attackers. If successful, this tunnel would grant the perpetrators a covert channel into the victim’s network, bypassing typical firewall rules and enabling the transfer of additional malicious tools or data exfiltration.

Cursor, a popular code‑editing platform that integrates AI assistance, distributes extensions through its marketplace, making it a lucrative vector for supply‑chain attacks. The incident underscores the growing risk of third‑party components in software development tools, where compromised packages can silently infiltrate development environments and propagate to downstream projects.

Following the disclosure, Cursor’s maintainers have issued an emergency update to remove the tainted extension and are urging users to verify their installations. Security experts recommend that developers employ strict vetting processes for plugins, monitor network traffic for unexpected outbound connections, and consider employing endpoint detection solutions that can flag unusual SSH activity. The episode serves as a reminder that even trusted development ecosystems are not immune to sophisticated supply‑chain threats, prompting calls for broader industry standards and more transparent auditing of AI‑driven extensions.