Cursor, Windsurf & Google Antigravity IDEs Linked to Malicious Extension Exposure

A critical supply-chain vulnerability in popular AI-powered IDE forks of VS Code (Cursor, Windsurf, Google Antigravity) allowed attackers to claim unregistered Microsoft-extension names on the OpenVSX registry and upload malicious extensions that the IDEs would auto-recommend. Researchers proved the issue by publishing harmless placeholder extensions that more than 1,000 developers installed; Cursor and Google have since rolled out fixes, Windsurf reportedly did not respond, and the Eclipse Foundation has taken steps to verify namespaces and remove unauthorized contributors.