SpaceX acquires Anysphere for $60 billion

SpaceX completed the acquisition of Anysphere, the developer of the artificial intelligence coding editor Cursor, for sixty billion dollars. The transaction was finalized in August, establishing SpaceX as the new owner of the software company. This acquisition places the Cursor platform, which holds a twenty-six percent market share among developers using artificial intelligence coding tools or agents, under the ownership of the aerospace and technology firm. The market share figure is derived from a developer survey conducted by Stack Overflow and released in early October.

The acquisition follows a significant security incident involving the Cursor marketplace. On the twenty-ninth of the previous month, malicious code disguised as an extension for Claude Code was registered on the platform. This malicious package was designed to install a Secure Shell backdoor, potentially affecting up to five thousand developers. The code was registered as an update to the official Claude Code extension, specifically versions two point one three one two and two point one three one three, for the Visual Studio Code environment developed by Microsoft. The malicious listing remained active on the marketplace for approximately eleven hours before it was detected and removed.

Security firm Phorion was the first to identify the threat. The malicious code was capable of operating on Windows, macOS, and Linux environments. It attempted to collect system information and open reverse Secure Shell tunnels. However, the scripts required administrator privileges to form these tunnels, which were not obtained in most environments, leading to connection failures. Despite these technical hurdles, The Register reported that stolen information had already been transmitted to attacker servers. The malware also established persistence mechanisms, including the insertion of attacker keys and scripts that execute upon system reboot.

Cursor responded by immediately removing the malicious version and blocking its distribution. The company temporarily suspended its entire Visual Studio Code marketplace as a precautionary measure. It conducted a full investigation of other extensions, replaced its own keys, and worked with the hosting provider to take the attacker servers offline. Cursor advised users to replace or revoke credentials and authentication sessions from trusted systems, noting that simply deleting the extension does not remove the installed backdoor or persistence mechanisms. Anthropic stated that the incident involved a fake version uploaded using marketplace privileges, not a breach of its own systems, and confirmed that existing versions provided through official channels remain safe. Neither Cursor nor Anthropic has yet disclosed how the malicious package passed the marketplace verification process.

Reported by The Elec.