A backdoored version of Anthropic’s official Claude VS Code extension was distributed through Cursor’s marketplace, affecting up to 5,000 developers, multiple sources reported Friday. Anthropic has not issued a public warning to customers about the incident.
The compromised package, version 2.1.313, was published through Anthropic’s official account on Cursor’s extension marketplace, according to independent researcher Kevin Beaumont and Luke Roberts, CTO and co-founder of security firm Phorian. Anthropic pushed version 2.1.314 several hours after the malicious version became available on Cursor. Neither Anthropic nor Cursor has explained how attackers gained control of the account.
According to Cursor, the malicious extension attempts to install a persistent SSH backdoor by adding an attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel. The code was designed to work on Windows, macOS, and Linux systems. Because Cursor extensions run with the permissions of the tool’s Integrated Development Environment, the backdoored version likely gained access to local files, source code, and developer tooling once installed.
“It was a supply-chain compromise where the attacker gained access to the official distribution channel,” Roberts told Ars Technica. “The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings.”