Cursor pulled its marketplace after a Claude Code extension attack

What Cursor says was exposed

Cursor said it verified there was no continuing risk and that no other extensions were affected.

Cursor

Source: the-decoder.com

The announcement leaves a gap: it does not say how many people installed the extension, or whether any information was actually collected. Cursor’s account describes what the malware tried to do, not what it succeeded in doing.

The marketplace is part of the attack surface

I think the administrator-permission requirement is reassuring only in a narrow sense. It may have blocked the remote-access attempt on most computers, but the extension still tried to gather identifying details and an IP address. The incident also shows that an extension store can become a security risk even when the underlying tool is familiar.

Cursor’s response was to take the whole marketplace offline, rather than remove only the affected extension. That limited access to the store while the company and its service providers checked for ongoing risk; the trade-off is that users temporarily lost access to every extension, including those Cursor says were unaffected.

The unanswered question is whether anyone installed the malicious version and what, if anything, it managed to collect. Without that information, users are left with a containment statement but no account of the incident’s actual reach.