SpaceX (SPCX.US)-backed Cursor hit by malicious extension breach! 5,000 users at risk, AI coding platform sounds security alarm

Zhitong Finance APP has learned that SpaceX (SPCX.US)-backed AI coding tool Cursor disclosed a security incident on Friday: a maliciously tampered Claude Code extension was live on its VS Code extension marketplace for about 11 hours and may have affected up to 5,000 users. The malicious version attempted to collect information such as user hostnames, usernames, operating systems, and public IP addresses, and sought to gain persistent access to affected devices by implanting SSH keys and establishing remote access channels.