Anthropic VS code extension on Cursor backdoored for nearly 12 hours

A malicious version of an official Anthropic extension for Anthropic's Claude model was distributed through Cursor's marketplace, according to multiple sources reported Friday. Anthropic has not yet warned customers about the incident.

The compromised package was a VS Code extension in the Cursor marketplace. Cursor said the malicious version, 2.1.313, affected "at most 5,000 users." Independent researcher Kevin Beaumont said Anthropic pushed version 2.1.314 several hours after 2.1.313 became available. Beaumont and Phorion CTO and co-founder Luke Roberts both said 2.1.313 was distributed through Anthropic's official account on Cursor.

Roberts told Ars Technica that the attacker gained access to the official distribution channel. He said the malicious version was posted to the Anthropic account and superseded 2.1.312. Extensions auto-update in Cursor by default, though users can change this in settings. Neither Cursor nor Anthropic has explained how the attackers gained control of the account.

Cursor said the malicious extension attempts to install a persistent SSH backdoor by adding an attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel. The code was written to work on Windows, macOS, and Linux. Cursor extensions run with the permissions of the development tool, so the backdoored version could likely access local files, source code, and developer tooling.

Phorion said the malware also collected variable names, which could help an operator identify cloud credentials and API tokens on a compromised device. Phorion said bugs in the Windows and macOS code prevented the backdoor from working in some cases, but the malware still installs persistence and sends host reconnaissance to the operator.

Cursor said its personnel worked with the cloud provider hosting the reverse shell server so infected devices could no longer reach it. The company removed the backdoored version, blocked further distribution, and shut down the VSCode Marketplace temporarily to rotate keys, audit access controls, and confirm no other extensions were compromised. The marketplace is now open.

Cursor said anyone who installed or updated the extension between 5:27 a.m. and 4:35 p.m. ET on Thursday should consider themselves affected. Both Cursor and Phorion have published indicators of compromise, including IP addresses and cryptographic hashes. Neither Anthropic nor Cursor answered questions about why Anthropic has not publicly warned customers or how the compromise occurred.