Malicious Claude Code extension in Cursor: an AI coding check for Dubai businesses

The tampered version sat in Cursor's VS Code extension marketplace for about eleven hours on Thursday, and Anthropic had no involvement in developing it. The Decoder reports that Cursor gave the count of affected users, so check now if you or your web team recently installed that extension.

What the extension tried to do on each machine

The extension went after user data such as hostname, username, operating system and public IP address. That's basic system information, but it tells an attacker which person and which computer they've reached. It also tried to set up remote access, though Cursor says that likely wouldn't have worked on most machines because it needs admin privileges.

Once the problem came to light, Cursor pulled the extension, took the entire marketplace offline and worked with providers to neutralise the malware. The marketplace came back after Cursor confirmed there was no further risk, and the company says no other extensions were affected.

Who this affects among businesses in the UAE

The report gives no figures by country, so we can't tell you how many UAE users installed it. Your exposure comes down to one question: did anyone working on your business use this extension in Cursor during those eleven hours?

You may never touch AI coding tools yourself, but the developer building your website or online store might. Their laptop tends to hold logins for hosting, your site admin and your ad account, so one bad extension matters beyond one machine. The report lists system details and doesn't mention passwords or keys, so keep this in proportion.

What a Dubai business should do now

Most of this is a few messages to the people who work on your site, so you're able to start today.

• Ask each person or agency working on your projects whether they installed or updated this extension in Cursor during those eleven hours.

• If anyone did, have them follow any guidance Cursor gives affected users, then change the passwords and API keys kept on that machine. That second step is our own caution, since the report doesn't say any were taken.

• Move daily coding work to a standard local account without admin rights, because the remote access attempt needed those rights.

• Give outside contractors their own logins with limited access, and close those logins when the job ends.

• Keep a short list of the extensions and AI tools used on your projects, and agree who approves a new one.

What to ask your web team about their tools

This attack used a name developers already knew, so a careful person could still have installed it. Ask which coding tools the team uses and who checks new extensions whenever you brief a web design company in Dubai. Put the same request to any team with access to your store, such as a Shopify agency in Dubai. If several hands have changed your site over the years, a sensible place to start is a technical website audit.

Keep an eye on your results for a few weeks after a scare like this, as well as your laptops. The Adnika Dashboard: one live view of a client's ads, analytics and CRM data, with AI recommendations reviewed by the strategist. A sudden drop in traffic or leads would sit there beside your ad results, which gives a client an early reason to ask questions.