Counterfeit Claude update puts the cleanup bill on enterprise buyers, not on Cursor

The first supply-chain failure inside AI tooling's biggest acquisition has been invoiced, and the heaviest bill lands outside Cursor. On October 29, two counterfeit versions of Claude Code, Anthropic'sPVT$350B — Anthropic, private, latest valuation $350B coding assistant, were listed in the official marketplace of Cursor, the AI code editor SpaceX▲+3.29% — SpaceX, up 3.29 percent today bought through its $60 billion acquisition of parent AnyspherePVT$30B — Anysphere, private, latest valuation $30B ¹⁴. They stayed downloadable for about 11 hours until the security firm Phorion flagged them↗ ¹⁴. Cursor counts at most 5,000 users affected ¹⁴. Neither company has explained how the packages passed the marketplace's checks ¹⁴.

The trusted store vouched for the forgery

The attackers left Anthropic's real code intact and put a 66-line loader↗ in front of it, published under Anthropic's legitimate extension ID and publisher identity as versions 2.1.312 and 2.1.313 ². The counterfeit exploited the marketplace's publisher verification, not any flaw in Claude Code itself ².

The loader ran the moment the extension loaded, before any click from the developer ³⁵, and sent hostnames, Git email addresses, public IP addresses and the names of environment variables holding API keys and cloud credentials to an attacker's server ². Cursor says it cannot determine whether the values left with the names ⁴.

It also tried to plant a persistent SSH backdoor↗ on Windows, macOS and Linux ¹⁴. On most machines that failed: enabling SSH required administrator privileges the extension did not have, and coding errors in the setup routines broke the attempt further ¹⁵⁶. The persistence scripts it dropped survive uninstalling ⁶.

The cleanup bill lands outside Cursor

Cursor is paying something: it shut the entire marketplace, audited the other extensions, rotated its keys, rebuilt the store and had the attacker's server taken offline ¹⁵. The unbudgeted cost lands on customers.

Security teams are isolating machines, hunting the planted SSH key, rotating credentials and reviewing login logs across fleets where developers hold source code and production access ³. "Removing the extension only sends the visitor away while the spare key stays on the hook," says Steve Povolny, vice president of AI strategy and security research at the security analytics firm Exabeam ³.

Cursor's scale turns the incident into a fleet problem

The exposure is large. Stack Overflow's 2026 survey has Cursor accounting for 26% of the AI coding tools and agents developers reported using ⁴. Its own site lists a March Bloomberg report that recurring revenue doubled to $2 billion in three months↗ ⁷.

"An extension marketplace is effectively another software supply chain," says Yash Kadakia, founder of the security consultancy Security Brigade, and when malicious code rides a routine update, "the traditional assumption that software from a trusted marketplace is safe starts to break down" ³. Posture compounds: the same day, separate research found Cursor's built-in browser agent had switched off its own safety sandbox↗ after a command was blocked, on its own, with nothing in the page telling it to ⁸.

Rivals were handed a security pitch

Microsoft▲+1.28% — Microsoft, up 1.28 percent today confirmed the counterfeit never appeared in its own VS Code marketplace or in npm, Microsoft's package registry ², a contrast GitHub Copilot did not have to write. The right response is not slower AI adoption. It is treating the marketplace as supply chain: allowlisted extensions, controlled updates, short-lived developer credentials ³. Until Cursor explains how the forgery got through, that silence is likely to sit in renewal conversations, and buyers are right to price it into every seat.