A Claude Code extension on Cursor's marketplace reportedly had a backdoor

12 hours the extension was reportedly compromised

According to a security newsletter roundup citing Ars Technica and WIRED, Anthropic’s official Claude Code extension on the Cursor Marketplace was compromised for nearly 12 hours, with a persistent backdoor planted on installs and auto-updates. The reports are said to describe a supply-chain compromise of the extension, not an AI agent acting on its own.

Alan's takeWhich extensions can your people install, and who is told the same day if one is pulled?