Tag: extension-security

Trust Boundaries in AI Coding Extensions: Auditing What Cursor Installs and Executes

A malicious Claude Code extension delivered through Cursor's supply chain shows how poisoned developer extensions abuse agent permissions, and how teams can audit installs, pin versions, and lock down update channels.