Anthropic: A tampered Claude Code extension came through Cursor’s marketplace, not its own

Anthropic said on Friday that a malicious actor used access to Cursor’s marketplace to publish a “tampered” copy of the Claude Code extension, which Anthropic says it did not build or publish. In its statement, posted by Anthropic’s Felix Rieseberg on X, the company said its own systems were not breached.

What Anthropic says happened

According to the statement, Anthropic is working with Cursor on the incident. It stresses that this “wasn’t a compromise of Anthropic’s systems or employee laptops.” The altered extension was, in Anthropic’s account, published by an outside party through Cursor’s marketplace, not through Anthropic’s own release process.

The post also says the versions on Anthropic’s official channels are the ones the company built and published. The excerpt available to us cuts off at that point, so the precise advice to users, such as which version numbers or extension identifiers to check, is not something we could confirm. Anyone who installs the Claude Code extension in Cursor should look for the full statement and for guidance from Cursor and Anthropic before relying on any copy already installed.

Cursor’s reported scale of exposure

Reuters reported on Friday, in a headline, that Cursor says up to 5,000 users were affected by the tampered extension. We could not read the full Reuters article, so we cannot say how Cursor arrived at that figure, how long the copy was available, or what it did on affected machines. Treat the number as Cursor’s estimate as reported by Reuters, not as a confirmed count.

What is still unknown

The public material leaves several basic questions open, and this article does not guess at them:

• How the actor obtained access to Cursor’s marketplace.
• What the tampered code actually did once installed.
• Whether the listing has been removed and affected users have been told to take action.
• Whether Cursor has published its own account of the incident.

Anthropic’s wording separates two things that are easy to blur. The Claude Code extension is Anthropic’s product, but the marketplace where Cursor users find it is run by Cursor. A copy published there under the product’s name can carry the product’s reputation without passing through the vendor’s build pipeline. That is the distinction Anthropic is drawing when it says it did not build or publish the copy.

What developers can do now

Based only on what Anthropic has said, the safe reference point is the version distributed on Anthropic’s official channels. Teams that use Cursor with Claude Code can compare what is installed against those channels, and watch for notices from both companies. Whether credentials or code on affected machines were exposed has not been stated in the material we could read, so no claim about that is made here.

We will update this report if Anthropic or Cursor publish technical details.