Cursor, Windsurf & Google Antigravity IDEs Linked to Malicious Extension Exposure
A critical supply chain vulnerability has been identified affecting numerous developers using AI-powered Integrated Development Environments (IDEs) such as Cursor, Windsurf, and Google Antigravity.
A critical supply chain vulnerability has been identified affecting numerous developers using AI-powered Integrated Development Environments (IDEs) such as Cursor, Windsurf, and Google Antigravity.
Security researchers have disclosed that these coding environments were inadvertently recommending non-existent extensions, which allowed potential attackers to introduce malware that users could inadvertently install.
The root of this issue lies in the development process of these tools. Cursor, Windsurf, and Antigravity are derived from Microsoft's Visual Studio Code (VS Code). However, due to licensing constraints, they cannot access the official Microsoft Extension Marketplace and instead utilize an open-source alternative known as OpenVSX.
During the adaptation of VS Code, these companies mistakenly included a configuration file containing a list of recommended extensions. This list triggered recommendations based on specific actions, such as opening certain file types or installing software like PostgreSQL.
The root of this issue lies in the development process of these tools.
Many of the Microsoft extensions mentioned in the configuration file were unavailable on the OpenVSX marketplace, creating a security gap. As these extension names were not registered on OpenVSX, they were susceptible to being claimed by unauthorized parties. An attacker could then upload a malicious file under a legitimate-sounding name, prompting the IDE to recommend its installation to users, who might unknowingly grant system access to the attacker.
Researchers demonstrated the vulnerability by registering these unclaimed namespaces and uploading benign placeholder extensions. The outcome was significant, with over 1,000 developers installing these empty files due to the IDE recommendations.
Cursor: Resolved the issue on December 1, 2025. Google: Initially dismissed the report as "Won't Fix," but subsequently addressed the vulnerability with updates by January 1, 2026. Windsurf: Has not yet responded to the disclosure.
The Eclipse Foundation, responsible for managing OpenVSX, has initiated steps to verify namespaces and eliminate unauthorized contributors to prevent further exploitation.
Based on reporting by GBHackers.