The wire · traced · first seen Oct 31, 09:32 UTC

Anthropic attacker published tampered Claude Code extension Cursor

A tampered Claude Code extension was published in Cursor's marketplace, leaving Cursor users to verify which copy they install.

L2 · reported1 source4 claims checked

What we checked

Every claim below was walked down the source ladder. The rung is how close the source is to the thing itself; the tense is the source's own.

1. announced L2 · reported

   A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension.

   per Techmeme (L2)
2. announced L2 · reported

   Anthropic did not build or publish the tampered copy.

   per Techmeme (L2)
3. announced L2 · reported

   Anthropic says its systems and employee laptops were not compromised.

   per Techmeme (L2)
4. announced L2 · reported

   Anthropic is working with Cursor on the incident.

   per Techmeme (L2)

Sources

• Anthropic says a malicious actor used access to Cursor's marketplace to publish a "tampered" copy of the Claude Code extension, which it didn't build or publish (Felix Rieseberg/@felixrieseberg) — Techmeme L2 · reported