Anthropic VS code extension on Cursor backdoored for nearly 12 hours

A malicious version of an official Anthropic extension for Claude was distributed through Anthropic's verified account on Cursor's marketplace, according to multiple reports cited in the source. The compromised version, 2.1.313, reportedly affected "at most 5,000 users."

Cursor said the malicious extension attempts to install a persistent SSH backdoor, add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel. Cursor said the code was written to work on Windows, macOS, and Linux. Because Cursor extensions run with the permissions of the tool's development environment, the source says the backdoor would likely have gained access to local files, source code, and developer tooling.

Phorian CTO and co-founder Luke Roberts said the operator could use stolen variable names to take inventory of cloud credentials and API tokens on compromised devices. Phorian said bugs in the Windows and macOS code prevented the backdoor from working in some cases. Roberts described it as a supply-chain compromise in which "the attacker gained access to the official distribution channel."

Anthropic pushed version 2.1.314 several hours after 2.1.313 appeared, according to independent researcher Kevin Beaumont. Cursor said it worked with its cloud provider to cut off infected devices from the reverse shell server, removed the malicious version, blocked further distribution, and temporarily shut down the VSCode Marketplace to rotate keys and audit access controls. Cursor said the marketplace is now open again.

The source says the attackers' method of gaining access to Anthropic's account is still unknown. Anthropic had not publicly notified customers at the time of reporting, and neither Anthropic nor Cursor answered questions about how the compromise occurred or why no public warning had been issued.

According to the source, anyone who installed or updated the extension from Cursor between 5:27 a.m. ET and 4:35 p.m. ET on Thursday should consider themselves affected. Cursor and Phorian publish indicators of compromise, including IP addresses and cryptographic hashes.