Marketplace Security

Marketplace security refers to the risks that come with app stores, plugin directories, and model hubs where companies download third-party AI tools, extensions, and models. Malicious or poorly maintained items in these marketplaces can carry hidden code, leak data, or quietly take control of the systems they run in. For compliance and risk teams, the key questions are who vets listings, how updates are checked, and whether the organization has an approved-source policy for what its staff and AI systems can install.

1 item

Corporate PolicyGlobal2026-10-31

Fake Anthropic Extension on Cursor Hit 5,000 Developers With SSH Backdoors

A malicious extension impersonating Anthropic's Claude Code tool was distributed through Cursor's AI developer marketplace for roughly 11 hours on October 29, 2026. It installed persistent remote access tools on affected machines and collected environment details linked to sensitive credentials. Cursor removed the extension, shut down its marketplace for auditing, and rotated access keys, but how attackers published under Anthropic's name remains unexplained.

supply chain attack AI developer tools Anthropic Cursor SSH backdoor credential theft marketplace security