GlassWorm Malware Targets AI IDEs Including Cursor and Windsurf

GlassWorm is a malicious worm targeting developer toolchains, including Microsoft's VS Code and AI coding tools Cursor and Windsurf. Because integrated development environments can access source code, credentials and deployment workflows, a compromise could spread from an individual computer to the corporate software supply chain.

A cybersecurity company recently disclosed that GlassWorm infiltrates the three IDEs through a malicious loader written in Zig and disguised as the popular WakaTime developer package. The malware can escape Node.js sandbox restrictions and gain system-level privileges. Existing reports do not specify the disclosure date, the number of victims or the amount of financial losses.