Cursor, Windsurf & Google Antigravity IDEs Recommend Malicious App Extension to Developers

Cybersecuritynews •Abinaya • January 6, 2026

A critical security flaw in popular AI-powered development environments has put millions of developers at risk of installing malicious software extensions. The Cursor, Windsurf, and Google Antigravity AI IDEs, with over a million users combined, were found recommending extensions that don’t exist in their respective marketplaces. These tools, all forked from VSCode, inherited configuration files […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious App Extensions Recommended by Popular AI IDEs A security flaw in AI-powered development environments Cursor, Windsurf, and Google Antigravity has exposed millions of developers to potential malware. These IDEs, which have over a million users combined, were found recommending non-existent extensions, leading to the risk of installing malicious software. All three tools are derived from VSCode and share similar configuration vulnerabilities. 2 sources 20

Extracted Entities

Cursor, Windsurf & Google Antigravity IDEs Recommend Malicious App Extension to Developers

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (3)