According to The Decoder, the modified Claude Code extension was on Cursor's marketplace for about 11 hours. It is reported that it attempted to steal user data and establish remote access; potentially up to 5 000 users were affected.
Cursor fully disabled the marketplace and then restored it after confirming that no further risk remained. The source does not specify which data may have been affected or how many users were actually harmed.
The case is important because the extension from the developer catalog became a potential channel for compromise. At the same time, the available package does not include a primary statement from Cursor or a second independent source, so assessment of the scale and technical details remains limited.
editorial commentary
Why it matters
Likely consequence — tighter review of extensions and access controls in developer tool marketplaces. The next observable signal will be Cursor's public explanation of the incident mechanism and protection measures. Substantial uncertainty remains regarding the actual number of affected users and the extent of the data leak.