SpaceX (SPCX.US) Cursor has been hacked by a malicious extension! 5,000 users at risk, AI programming platform sounded a security alarm

The Zhitong Finance App learned that Cursor, an AI programming tool owned by SpaceX (SPCX.US), revealed a security incident on Friday: a maliciously tampered Claude Code extension went live for about 11 hours on its VS Code extension market, which could affect up to 5,000 users. The malicious version attempted to collect information such as the user's host name, user name, operating system, and public network IP, and obtain continuous access to the affected device by implanting an SSH key and establishing a remote access channel.

Cursor said the extension in question was not developed by Anthropic, and the malicious version went live on its market between 2:27 a.m. and 1:35 p.m. Pacific time on Thursday. Once the issue was discovered, Cursor immediately removed the malicious version and prevented its continued distribution, while closing the extension market for full review, then rebuilding the market and resuming service. According to the company, there is currently no evidence that other extensions have been tampered with.

The immediate impact of this incident may seem limited, but for Cursor, its significance is more than just an expansion of the market security incident. As an AI software business owned by SpaceX, Cursor is trying to expand the number of enterprise customers in the increasingly competitive AI programming market. As AI programming tools move from code completion to intelligent agents that can perform tasks independently, the development environment gradually becomes an entry point for enterprise core data and system permissions, and whether the platform can ensure expanded ecological security is becoming an important factor affecting the prospects of commercialization.

Malicious extensions target developer devices: insufficient administrator rights do not mean there is no risk

According to the security bulletin issued by Cursor, the issue was extended to Anthropic.claude-code version 2.1.313. Malicious code is inserted into the extension's JavaScript program to try to collect device and user information, including host name, user name, operating system, CPU architecture, working directory, Git mailbox configuration, and public network IP address after the extension starts.

What is more alarming is that the malicious code also attempted to add the public key controlled by the attacker to the user's SSH authorization key file, start a local SSH service, and establish a reverse SSH tunnel, thus creating conditions for the attackers to remotely access the device. At the same time, malicious programs are also trying to establish persistent operation capabilities through mechanisms such as macOS's LaunchAgent or Windows Scheduled Tasks, so that related programs may continue to run even after the extension is shut down.

Cursor said that starting the local SSH service requires administrator rights, and malicious extensions usually do not have this permission, so on most macOS and Windows devices, the key step of establishing a remote access channel will fail. That doesn't mean the device isn't affected at all, though. Cursor specifically warns that malicious code may still add unauthorized SSH keys, install persistent scripts, and send device information, so simply uninstalling the extension is not enough to ensure security.

Cursor has cooperated with relevant cloud service providers to take the servers used by the attackers offline and announced inspection and repair solutions for macOS and Windows devices. For users who have installed or updated this version of the extension within the above time window, the company recommends checking the SSH authorization key and persistent files, isolating the device, removing malicious programs if necessary, and replacing potentially affected credentials from trusted devices.

Judging from the handling of the incident, Cursor took measures such as removing the malicious version, shutting down the market, rotating keys, and rebuilding the market, but the incident still revealed an issue worth paying attention to: when the AI programming platform simultaneously undertakes expanded distribution and development environment management functions, is the audit mechanism for third-party code entering user devices strict enough?

SpaceX's AI programming business faces a test: platform trust is more important than growth stories

At the time of this incident, Cursor was in a phase of rapid change in the competitive landscape of AI programming tools.

In 2026, Anthropic's Claude Code rapidly expanded its developer base, while Cursor continues to rely on multi-model support, codebase indexing, and agent workflows to compete for professional developers and enterprise customers. SpaceX previously announced the acquisition of Cursor's parent company AnySphere, with a transaction scale of about 60 billion US dollars, further highlighting the strategic position of AI programming tools in its software business. Reuters reported on Friday that Cursor is now a programming tool business owned by SpaceX.

For SpaceX, the value of Cursor is not just an AI application product, but also involves the developer ecosystem, the enterprise software market, and the entrance to future AI agent workflows. If AI programming tools are to move from the individual developer market to enterprise-level applications, in addition to model performance and code generation efficiency, they must also meet the requirements of enterprises for data protection, access control, software supply chain, and compliance governance.

In this incident, the malicious code did not come from Anthropic's official website, but rather entered user devices through Cursor's own expansion market. In other words, the problem isn't that Claude Code itself has a bug, but that a tampered version has appeared on a third-party extension distribution channel.

This distinction is particularly important for platform responsibilities. Although Cursor is not a developer of malicious code, it is an operator of expanding the market. For enterprise customers, users generally don't review each extension's code source and execution rights one by one, and rely on the review, signing, distribution, and update mechanisms provided by the platform. Once the platform becomes a channel for malware to enter the development environment, even if the problem is eventually brought under control, it will increase the pressure on companies to re-evaluate their security capabilities.

Especially after SpaceX acquired Cursor, the market's expectations for this business are no longer limited to user growth and revenue expansion. As it gradually undertakes larger enterprise development workflows, platform security incidents may affect customer procurement decisions, enterprise deployment speed, and long-term commercialization capabilities. This incident involving up to 5,000 users is not enough to show that Cursor's enterprise business has been substantially impacted, but it reminds the market that competition for AI programming platforms is extending from “who can write better code” to “who can manage code and development environments more securely.”

AI agents expand their attack surface: software supply chain security becomes a new battleground for the cybersecurity industry

The Cursor incident is not an isolated phenomenon, but a microcosm of the conflict between the expansion of AI programming tool capabilities and traditional software supply chain security mechanisms.

Traditional software supply chain attacks are usually carried out through malicious open source components, tampered software packages, third-party dependency libraries, or development tools. Attackers don't necessarily need to directly attack the core system of the enterprise; as long as they can pollute the software components used by the developer, they have the opportunity to use the developer's own permission to enter the enterprise environment.

AI programming agents further expand this risk boundary. Unlike traditional code completion tools, tools such as Claude Code, Cursor Agent, and GitHub Copilot can read project files, execute terminal commands, call external tools, and operate code repositories with developer permission. As MCP servers, Agent Skills, and third-party extensions gradually become part of the development process, developers install components that may not only affect code quality, but also directly gain the ability to access local files, environment variables, and enterprise systems.

This means that once a malicious extension enters the development environment, its potential impact may extend far beyond a normal browser plug-in or editor theme. For developer devices with access to cloud services, write access to code repositories, or deployment credentials, attackers may use these privileges to further expand their reach.

Security research institutes and cybersecurity vendors have begun to see this issue as a new market opportunity. The Software Supply Chain Security Magic Quadrant Report released by Gartner in 2026 included third-party software risks, open source components, and third-party AI in the scope of discussions in the software supply chain security market, and listed relevant vendors such as Chainguard, Checkmarx, GitHub, JFrog, Sonatype, and Veracode.

Cybersecurity giants are also speeding up their deployment. CrowdStrike launched real-time software supply chain attack protection capabilities in September this year. The focus is on identifying and intercepting malicious open source packages through a terminal security platform before execution. Palo Alto Networks has launched a security solution for AI programming, covering AI agent identification, supply chain risk assessment, agent identity and operation authority management.

These layouts reflect the emerging needs of the cybersecurity industry: security protection targets are no longer limited to traditional servers, terminals, and network traffic; they also need to cover the tools, third-party components, developer identity, and automated execution behavior used by AI agents.

For related vendors, the popularity of AI programming tools may expand the demand for software supply chain security, terminal protection, identity management, and cloud security products. However, whether this trend translates into actual revenue growth still depends on enterprise security budgets, product deployment effectiveness, and competition among vendors.

The AI programming tool race enters the second half: security capabilities will influence enterprise customer choices

From a longer-term perspective, the Cursor incident revealed not only the problem of expanding the market review mechanism, but also the security governance challenges facing the entire AI programming ecosystem.

When AI tools only take on code suggestions and autocompletion tasks, their potential permissions are relatively limited; however, when AI agents begin to independently read files, execute commands, call external services, and participate in the deployment process, developers are actually handing over more system permissions to the AI tool and the third-party components it connects to.

This also extends security issues from traditional code vulnerability detection to multiple levels such as tool permission management, identity authentication, operating environment isolation, software package source verification, and operational behavior auditing. Businesses need more than an AI model that can generate code; they also need a complete system that can restrict agent behavior, track data access, and ensure that third parties rely on trust.

For SpaceX's Cursor, the direct loss of this incident is still difficult to quantify, but the test of trust in the platform has already been shown. Cursor quickly removed from the shelves and rebuilt the market, indicating that it has a certain ability to respond to incidents; however, in the end, what enterprise customers are more concerned about is whether the platform can establish a continuous and effective security review and authority management mechanism to prevent similar problems from occurring over and over again.

The competition for AI programming tools is extending from model capability, product experience, and computing power resources to platform reliability. As more companies hand over core development workflows to AI agents, safety is no longer just a remediation cost after an accident occurs, but may become an important factor in determining whether the platform can enter the enterprise market, maintain customer trust, and support long-term valuations.