---
format: "aidr-story-markdown/v1"
id: "38991824b1cfd36a7131b97712f8e5dc8cc78b59727fc90f1f089bd7515e3ecf"
canonical_url: "https://aidr.today/38991824?lang=en"
title: "Cursor Estimates Up to 5,000 Users Affected by Malicious Marketplace Extension"
lang: "en"
requested_lang: "en"
available_langs: ["en","vi"]
translation_fallback: null
fallback_fields: []
published_at: "2026-11-14T08:53:35.000Z"
category: "Tools"
topics: ["anthropic","safety","devtools"]
source_urls: ["https://marketbrief.now/cybersecurity/cursor-estimates-up-to-5000-users-affected-by-malicious-marketplace-exte-a69580d9","https://x.com/cursor_ai/status/2121411147714970092","https://x.com/WSJ/status/2121388011485106587","https://x.com/DarkWebInformer/status/2121316554075676880","https://x.com/hrkrshnn/status/2121428647152095333","https://x.com/S1r1u5_/status/2121447753410904131","https://huggingnews.com/cybersecurity/cursor-estimates-up-to-5000-users-affected-by-malicious-marketplace-exte-a69580d9"]
summary: "A malicious version of the Claude Code extension potentially reached 5,000 users through a security failure in the Cursor AI coding assistant marketplace. Cursor advised affected teams to rotate credentials and audit systems for backdoors. Cybercriminals also stole internal credentials from Fireworks AI in October, which led to the theft of driver's license details for at least 7,870 drivers in Rhode Island, South Carolina, and Massachusetts."
---

# Cursor Estimates Up to 5,000 Users Affected by Malicious Marketplace Extension

> [Open the canonical story](<https://aidr.today/38991824?lang=en>)

**Published:** 2026-11-14T08:53:35.000Z
**Category:** Tools
**Topics:** anthropic, safety, devtools

## Summary

A malicious version of the Claude Code extension potentially reached 5,000 users through a security failure in the Cursor AI coding assistant marketplace\. Cursor advised affected teams to rotate credentials and audit systems for backdoors\. Cybercriminals also stole internal credentials from Fireworks AI in October, which led to the theft of driver's license details for at least 7,870 drivers in Rhode Island, South Carolina, and Massachusetts\.

## Sources

- [Story source](<https://marketbrief.now/cybersecurity/cursor-estimates-up-to-5000-users-affected-by-malicious-marketplace-exte-a69580d9>)
- [Story source](<https://x.com/cursor_ai/status/2121411147714970092>)
- [Supporting source](<https://x.com/WSJ/status/2121388011485106587>)
- [Supporting source](<https://x.com/DarkWebInformer/status/2121316554075676880>)
- [Supporting source](<https://x.com/hrkrshnn/status/2121428647152095333>)
- [Supporting source](<https://x.com/S1r1u5_/status/2121447753410904131>)
- [Story source](<https://huggingnews.com/cybersecurity/cursor-estimates-up-to-5000-users-affected-by-malicious-marketplace-exte-a69580d9>)