Cursor IDE Supply-Chain Breach: Malicious Claude Code Extension Detection and Remediation

Cursor has confirmed a security breach that allowed attackers to distribute a malicious Claude Code extension through its official marketplace. The intrusion originated from the theft of credentials belonging to AI infrastructure provider Fireworks AI, which were then used to compromise Cursor's extension publishing pipeline. This incident underscores the escalating risk of supply-chain attacks targeting developer tools and AI coding assistants, where a single compromised credential can cascade into widespread developer machine compromise.

Security teams must act immediately to identify and remove the malicious extension, audit extension installations, and enforce stricter controls over IDE extension marketplaces and third-party AI service integrations. The breach highlights the critical need for robust credential management, extension vetting, and behavioral monitoring within developer environments.

Technical Analysis

Affected Products, Versions, and Platforms

• Cursor IDE: The AI-powered code editor that hosts the extension marketplace.
• Claude Code Extension: A malicious version of the Claude Code extension was distributed via Cursor's marketplace.
• Fireworks AI: The AI infrastructure provider whose credentials were stolen, serving as the initial access vector.
• Developer Workstations: Any system running Cursor with the compromised extension installed, across Windows, macOS, and Linux.

CVE Identifiers and CVSS Scores

No specific CVE identifier was provided in the source news item. This incident is a supply-chain compromise leveraging stolen credentials and marketplace trust, rather than a discrete software vulnerability. The attack technique aligns with MITRE ATT&CK techniques such as T1195 (Supply Chain Compromise) and T1078 (Valid Accounts).

How the Attack Works (Defender's Perspective)

1. Initial Access: Attackers stole credentials from Fireworks AI, an AI infrastructure provider used by Cursor.
2. Lateral Movement: Using these credentials, attackers gained unauthorized access to Cursor's extension publishing or marketplace infrastructure.
3. Payload Delivery: They uploaded a malicious version of the Claude Code extension to Cursor's marketplace.
4. Execution & Persistence: Developers who installed or updated the extension via Cursor's marketplace executed malicious code on their workstations. The extension could exfiltrate data, execute commands, or establish persistence.
5. Command & Control: The malicious extension likely communicated with attacker-controlled infrastructure to receive commands or exfiltrate data.

Exploitation Status

• Confirmed Active Exploitation: The breach and distribution of the malicious extension have been confirmed by Cursor. The extension was actively distributed through the official marketplace.
• No Public PoC: No public proof-of-concept exploit code has been released, but the attack is a real-world, in-the-wild supply-chain compromise.
• CISA KEV: Not applicable, as no specific CVE is associated with this incident.

Detection & Response

Executive Takeaways

• Immediately audit all Cursor IDE installations for the presence of the Claude Code extension, especially versions installed or updated after the breach disclosure.
• Enforce strict controls on IDE extension marketplaces, including manual review, code signing, and allowlisting.
• Implement robust credential management and rotation policies for all third-party AI service providers and development infrastructure.
• Monitor for anomalous process execution, network connections, and file modifications originating from IDE processes or extension directories.
• Conduct a thorough review of developer workstation security posture, including EDR coverage, least privilege, and application control.
• Engage in threat hunting for indicators of compromise related to the malicious extension and its potential payloads.

SIGMA Rules

---
title: Suspicious Process Spawned by Cursor IDE Extension
id: 8f2c4a6e-1b3d-4e5f-9a7c-2d1e3f5a6b7c
status: experimental
description: Detects suspicious processes spawned by Cursor IDE or its extensions, which may indicate execution of malicious code from a compromised extension.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.supply_chain_compromise
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\cursor.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection
falsepositives:
  - Legitimate development tools or scripts launched by Cursor extensions.
level: high
---
title: Network Connection from Cursor IDE to Suspicious Domain
id: 3e5f7a9c-2d4e-5f6a-8b9c-1d2e3f4a5b6c
status: experimental
description: Detects network connections from Cursor IDE to domains associated with the malicious extension or command-and-control infrastructure.
references:
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.supply_chain_compromise
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\cursor.exe'
    DestinationHostname|contains:
      - 'malicious-domain.com'
      - 'c2-server.net'
  condition: selection
falsepositives:
  - Legitimate network activity from Cursor or its extensions.
level: high

KQL (Microsoft Sentinel / Defender)

// Hunt for processes spawned by Cursor IDE or its extensions
DeviceProcessEvents
| where InitiatingProcessFileName =~ "cursor.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

// Hunt for network connections from Cursor IDE to suspicious domains
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "cursor.exe"
| where RemoteUrl has_any ("malicious-domain.com", "c2-server.net")
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine

Velociraptor VQL

-- Hunt for processes spawned by Cursor IDE or its extensions
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Ppid
FROM pslist()
WHERE Exe =~ 'cursor.exe'
   AND (Name =~ 'cmd.exe' OR Name =~ 'powershell.exe' OR Name =~ 'wscript.exe' OR Name =~ 'cscript.exe' OR Name =~ 'mshta.exe' OR Name =~ 'rundll32.exe' OR Name =~ 'regsvr32.exe')

-- Hunt for network connections from Cursor IDE
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, RemoteIP, RemotePort, Status
FROM netstat()
WHERE Exe =~ 'cursor.exe'
   AND (RemoteIP =~ 'malicious-domain.com' OR RemoteIP =~ 'c2-server.net')

Remediation Script (PowerShell)

# Script to audit and remove malicious Claude Code extension from Cursor IDE
# Run with administrative privileges

$cursorExtensionsPath = "$env:USERPROFILE\.cursor\extensions"
$maliciousExtensionName = "claude-code"

# Check if Cursor extensions directory exists
if (Test-Path $cursorExtensionsPath) {
    Write-Host "Cursor extensions directory found: $cursorExtensionsPath"

    # List all installed extensions
    $installedExtensions = Get-ChildItem -Path $cursorExtensionsPath -Directory
    Write-Host "Installed extensions:"
    $installedExtensions | ForEach-Object { Write-Host "  $($_.Name)" }

    # Check for malicious extension
    $maliciousExtension = $installedExtensions | Where-Object { $_.Name -like "*$maliciousExtensionName*" }
    if ($maliciousExtension) {
        Write-Warning "Malicious extension found: $($maliciousExtension.FullName)"
        # Remove malicious extension
        Remove-Item -Path $maliciousExtension.FullName -Recurse -Force
        Write-Host "Malicious extension removed."
    } else {
        Write-Host "No malicious extension found."
    }
} else {
    Write-Host "Cursor extensions directory not found. Cursor may not be installed."
}

# Check for suspicious processes
$suspiciousProcesses = Get-Process | Where-Object { $_.ProcessName -in @("cmd", "powershell", "wscript", "cscript", "mshta", "rundll32", "regsvr32") } | Where-Object { $_.Parent.ProcessName -eq "cursor" }
if ($suspiciousProcesses) {
    Write-Warning "Suspicious processes found:"
    $suspiciousProcesses | ForEach-Object { Write-Warning "  $($_.ProcessName) (PID: $($_.Id))" }
    # Terminate suspicious processes
    $suspiciousProcesses | ForEach-Object { Stop-Process -Id $_.Id -Force }
    Write-Host "Suspicious processes terminated."
} else {
    Write-Host "No suspicious processes found."
}

Write-Host "Audit and remediation complete."

Remediation

Immediate Actions

1. Audit and Remove: Immediately audit all Cursor IDE installations for the presence of the Claude Code extension. Remove any versions installed or updated after the breach disclosure.
2. Credential Rotation: Force rotation of all credentials associated with Fireworks AI and any other third-party AI service providers used by Cursor or within your development environment.
3. Extension Allowlisting: Implement strict allowlisting for IDE extensions, permitting only vetted and approved extensions to be installed.
4. Network Segmentation: Isolate developer workstations from critical infrastructure and sensitive data where possible, and monitor network traffic for anomalous connections.
5. EDR Deployment: Ensure EDR solutions are deployed and configured to monitor developer workstations, with specific rules to detect anomalous process execution and network activity from IDE processes.

Vendor and CISA Guidance

• Cursor Advisory: Monitor Cursor's official security advisories and blog for updates and specific remediation guidance: https://cursor.sh/security
• Fireworks AI Advisory: Monitor Fireworks AI's official communications for details on the credential theft and any recommended actions: https://fireworks.ai/
• CISA Guidance: While no specific CISA KEV entry applies, follow CISA's general guidance on supply-chain security and credential management: https://www.cisa.gov/supply-chain-security

Long-Term Controls

• Zero Trust Architecture: Implement zero trust principles for developer environments, verifying every access request and enforcing least privilege.
• Code Signing and Verification: Require code signing for all extensions and verify signatures before installation.
• Behavioral Monitoring: Deploy behavioral monitoring to detect anomalous activity from IDE processes and extensions.
• Regular Security Assessments: Conduct regular security assessments and penetration tests of development infrastructure and third-party integrations.
• Security Awareness Training: Educate developers on the risks of supply-chain attacks and the importance of verifying extension integrity.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub