Claude Code's Cursor Marketplace Extension Carried a Backdoor, Phorion Reports

If you run Claude Code inside Cursor, a new write-up from Phorion says the extension you installed carried a backdoor. Check it before you trust it with another repo.

Attacks on AI coding tools used to look like one-off curiosities. Now they arrive as a sequence, and each one lands closer to the agent itself.

July 2025: Amazon Q Developer’s VS Code extension shipped with a destructive prompt an attacker had slipped into it.

October 2025: A self-spreading campaign called GlassWorm hit extensions on Open VSX, the registry Cursor pulls from instead of Microsoft’s store.

Today: Phorion publishes its account of a backdoor in the Claude Code for VS Code extension on the Cursor Marketplace. The URL calls it a compromise of the official extension.

The through-line is the target.

First the attackers went after the agent’s instructions. Then they went after the registry, hoping you would install something sketchy. Now the claim is that the official package was the way in.

The mechanism is what makes this expensive. A VS Code extension runs in the extension host with your user’s permissions. A coding-agent extension is also built to be trusted. It reads your files, runs terminal commands and holds your API credentials.

A backdoor in a normal extension inherits ordinary editor access. A backdoor in an agent extension inherits the access you deliberately handed to the agent.

That is why “official” has stopped being a safety signal. Cursor is a VS Code fork with its own marketplace, so a publisher name there is only as trustworthy as that registry’s publishing controls. Those controls are what the Phorion post puts in question.

I am working from Phorion’s headline claim here, not a verified technical teardown. The payload, the affected versions and the exposure window all belong to their write-up. Read it before you rotate anything.

The practitioner read is blunt. Treat agent extensions like production dependencies, not like a theme. Pin the version. Update on purpose, not automatically. Run the agent where a stolen token reaches as little as possible: scoped keys, a dev container, no ambient cloud credentials. If you are building out a Claude Code setup with plugins and MCPs, the daily-driver guide covers where those permission boundaries sit.

The prediction: by the end of this year, another first-party extension from a major AI coding vendor will be reported compromised on a VS Code-fork marketplace. If that does not happen, the pattern was three coincidences. I do not think it was.

One AI signal a day. 90 seconds. No fluff. Subscribe and get the next one in your inbox.