Devs Hit by Trojanized Claude Code Extension for Cursor
Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).
Excerpt from the primary source: Dark Reading
Who is affected
Small businesses · Developers
Affected technology: Claude
What you should do
No specific action is required at this time.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners.
In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
Noteworthy stories that might have slipped under the radar: Iran eyed in military freezer hacks, Copenhagen University breach, AI-powered malware.
Malicious Claude Code extension on Cursor planted SSH backdoors
A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.
Claude Model Builds Exploits Across Major Browsers & OSes
An unreleased version of the AI model has found and chained multiple vulnerabilities in Chrome, Safari, Android, Windows, and Linux, Anthropic says.