The Decoder· Matthias Bastian·· 5 h ago
Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft
Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft
AI summary
A tampered Claude Code extension was live on the Cursor marketplace for about 11 hours, affecting up to 5,000 users. It tried to steal user data and set up remote access. Cursor took the entire marketplace offline and reinstated it after confirming there was no further risk.
Selection record
Threshold 76Media and individualsFirst 58Second 58
Not admittedSum of both 116 < twice the threshold 152
- Source tier
- Media and individuals; this tier's threshold is 76
- Pre-filter
- passed：恶意Claude Code扩展窃取数据，属AI安全事件
- Same event
A model scores each item twice, independently, against one written standard, out of 100. An item is admitted only when the two scores add up to twice the threshold. The threshold is set per source tier.
Source: The Decoder · the-decoder.com