Cursor's trojanized Claude Code extension hit up to 5,000 users; OpenAI cuts Cursor's models November 12
A trojanized Claude Code extension distributed through Cursor's own marketplace hit up to 5,000 users, and OpenAI pulls the editor's models on November 12, citing distrust of owner SpaceX. The $60 billion all-stock deal now sits on Space Exploration Technologies shareholders' books.
Vincent Jiang · 4 min read
Cursor, Anysphere's$30B — Anysphere, private, latest valuation $30B AI code editor and SpaceX's−3.49% — SpaceX, down 3.49 percent today $60 billion acquisition, disclosed on October 30 that a modified, compromised Claude Code extension for VS Code was distributed through its own extension marketplace, affecting at most 5,000 users 12. The company pulled the marketplace, worked with providers to remove the malware and reinstated it with new guidance, telling users to update Claude Code for VS Code to version 2.1.314 1. The tampered code was not written by Anthropic$350B — Anthropic, private, latest valuation $350B 1.
A backdoor hidden in a trusted update
The details sharpen the risk. The malicious build, version 2.1.313, appeared under Anthropic's legitimate extension ID and carried a 66-line loader that added an attacker-controlled SSH key, installed persistence and sent host data to a remote server 5.
The captured material included the names of environment variables containing keys, tokens or secrets 5. Cursor's analysis puts the exposure window at roughly 2:27 a.m. to 1:35 p.m 5. Pacific on October 29 5. Three days earlier, JFrog's security researchers had reported 42 hijacked GitHub repositories carrying payloads that fire when developers open folders in AI coding tools, Cursor among them 6. What is new now is a confirmed, company-disclosed incident inside Cursor's own marketplace, not another research finding.
The buyer of record: Space Exploration Technologies (SPCX) shareholders
SpaceX paid $60 billion in stock for Cursor, closing on August 14 and folding the editor into SpaceXAI, SpaceX's AI arm, on about $2.6 billion of annualized B2B revenue, more than 50,000 customer teams and the majority of the Fortune 500 3. The purchase price rests on teams keeping their subscriptions, and the buyers include Salesforce+0.72% — Salesforce, up 0.72 percent today, which reports developer velocity up more than 30%, and NVIDIA−3.36% — NVIDIA, down 3.36 percent today, whose 30,000 developers commit three times more code with Cursor 3.
Space Exploration Technologies (SPCX) trades at a $1.95 trillion market cap, 71.06 times sales near a one-year low against a 101.8 historical median, with negative trailing EPS 1. Insider activity is one-sided: no insider purchases and $53.7 million of insider sales in the past year 1.
The menu shrinks while the marketplace leaks
The breach lands in a month already crowded with trust questions for the company. OpenAI$500B — OpenAI, private, latest valuation $500B stops supplying models on November 12, stating: "We are making this choice because we cannot be confident that SpaceX will use our technology within our terms of service, based on our experience with Elon Musk's companies violating contracts" 4. Chief executive Michael Truell counters that OpenAI models serve about 5% of Cursor traffic 4.
Still, bundled OpenAI quotas vanish from Premium tiers, third-party models bill from the first token after the cutoff, and the $8 X Subscription Plus tier is Grok-only 4.
Cursor trails every rival in reported developer usage
Data
| Value | |
|---|---|
| Claude Code | 65.5% |
| GitHub Copilot | 58.7% |
| OpenAI Codex | 29.5% |
| Cursor | 25.5% |
That chart is the pressure in numbers. A controlled test ran Cursor and Claude Code on the same Claude Sonnet 5.5 model against 186 hidden checks: both passed every run, seconds apart 4. When the editor itself stops separating the tools, buyers choose on which models are bundled and how predictable the bill is, and Cursor's bundled menu is thinning while its marketplace carried malware 4.
What Cursor's account limits
Cursor says the malicious build is removed, other extensions in its marketplace were not affected, and it is contacting impacted users directly 15. The OpenAI cutoff touches about 5% of traffic by Truell's account 4, and Grok, bundled at $8, gains a distribution channel inside a widely used editor 4.
Claude models are among the frontier models developers can choose inside Cursor 3, and no source reports Anthropic restricting access. The unresolved problem is precedent: OpenAI has set the position that a model provider may cut a long-standing customer over who owns the parent 4.
Renewals are the next reading
Enterprise renewal commentary and marketplace guidance through November are the figures to watch. The $60 billion price holds only while the teams that measure their coding tools closely keep paying; a disclosed breach and a shrinking bundled menu give buyers reasons to pause 134. If renewals slow, the cost lands on SPCX shareholders who funded the deal in stock, and Claude Code, GitHub−1.51% — GitHub, down 1.51 percent today Copilot and Codex CLI are positioned to collect 134.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
