Anthropic's VS Code extension on Cursor was backdoored for nearly 12 hours
A malicious version of Anthropic's official Claude extension was available in the marketplace of developer tool Cursor and may have affected up to 5,000 users. Anthropic has not yet publicly warned customers.
A backdoored version of Anthropic's official extension for its Claude AI model, built for the VS Code code editor, put as many as 5,000 developers' computers at risk, several sources reported on Friday. The extension was offered in the marketplace of Cursor, a maker of AI-assisted developer tools.
Cursor said the malicious version, 2.1.313, affected at most 5,000 users, presumably when they downloaded it or when their systems fetched and installed it automatically.
How it happened
Independent researcher Kevin Beaumont said Anthropic released version 2.1.314 several hours after the earlier version appeared on Cursor. He and Luke Roberts, CTO and co-founder of security firm Phorian, both said version 2.1.313 was distributed through Anthropic's official account on Cursor.
Roberts described it as a supply-chain compromise in which the attacker gained access to the official distribution channel, with the malicious release superseding 2.1.312. Extensions in Cursor update automatically by default, though users can change this in settings. Neither Cursor nor Anthropic has explained how the attackers took control of the account.
What the malicious code did
According to Cursor, the extension tried to install a persistent SSH backdoor. It added an SSH key controlled by the attacker, enabled the local SSH service and opened a reverse SSH tunnel. The code was written to run on Windows, macOS and Linux.
Because Cursor extensions run with the permissions of the tool's integrated development environment, the compromised version would likely gain access to local files, source code and developer tooling once installed. Anthropic has so far not issued a public notice about the incident to its customers.
