Trust Boundaries in AI Coding Extensions: Auditing What Cursor Installs and Executes
A malicious Claude Code extension served through Cursor's supply-chain path is a reminder that the editor is the least-audited privileged process on a developer laptop. We keep lockfiles for npm dependencies and SBOMs for production services, then install extensions into a Node.js process that can read ~/.ssh and ~/.aws/credentials, inherit every token exported in the launching shell, and spawn any binary the user can spawn. This video walks the reproducible part: how the VS Code extension host works and why it is a full runtime rather than a sandbox, how activation events like a wildcard event or a workspace-contains rule fire with no user action, and what the terminal commands show when you list your installed extensions and read the metadata record for versions and install paths. It also covers why a marketplace signature is a tampering control and not a code review, why an AI coding extension turns a static install into a standing capability because the model chooses commands at runtime, and how project-scoped MCP server entries can arrive with a clone. The fix is scoped and practical: deny by default and allowlist specific command prefixes, review project-scoped MCP servers before they start, pin extension versions, and treat auto-run as equivalent to running the repository's code with your credentials. Defensive, lab-scoped, and runnable on your own machine. On the underlying report: SecurityWeek published a piece on 2 November 2026 describing a malicious extension distributed under Claude Code branding through the Cursor distribution path. Details such as the extension identifier, affected version range, and payload behaviour are not established here, and this video does not guess at them. The audit steps work whether or not an advisory ever exists. Full write-up: https://hackyjs.com/posts/trust-boundaries-in-ai-coding-extensions-auditing-what-cursor-installs-and-executes