Anthropic Claude extension backdoored on Cursor for 12 hours

Lead

Ars Technica reports that an official extension for Anthropic’s Claude model was backdoored and distributed through the Cursor marketplace, threatening as many as 5,000 developers’ machines. The incident involved version 2.1.313 of the VS Code extension, which was posted to Anthropic’s official account on Cursor and remained live for nearly 12 hours before being replaced by version 2.1.314. Despite the severity of the breach, Anthropic has not yet issued a public notice to customers regarding the incident.

The compromised package was a supply-chain attack where the attacker gained access to the official distribution channel, effectively superseding the previous safe version 2.1.312. Because Cursor extensions auto-update by default, users who had the extension installed likely fetched the malicious version automatically without manual intervention. Both independent researcher Kevin Beaumont and Luke Roberts, CTO and co-founder of security firm Phorian, confirmed that the malicious version was distributed through Anthropic’s official account on Cursor.

The details

Cursor stated that the malicious extension attempted to install a persistent SSH backdoor by adding an attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel. The code was written to function across Windows, macOS, and Linux. Since Cursor extensions run with the permissions of the Integrated Development Environment, the backdoored version likely gained access to local files, source code, and developer tooling once installed.

Phorian noted that the theft of variable names allowed the operator to quickly take inventory of cloud credentials and API tokens stored on compromised devices. This reconnaissance likely enabled the attacker to prioritize which machines to target in follow-up attacks. Although bugs in the malicious code for Windows and macOS prevented the backdoor from working in some cases, Phorian emphasized that "the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator."

Cursor personnel worked with the cloud provider hosting the server the reverse shell connected to, ensuring infected devices could no longer reach it. The company removed the backdoored version from the marketplace, blocked further distribution, and temporarily shut down the VSCode Marketplace to rotate keys and audit access controls. The marketplace is now open. Both Cursor and Phorian have listed various indicators of compromise, including IP addresses and cryptographic hashes, to help users identify affected systems.

Context

This incident highlights the growing risks associated with AI-assisted developer tools and their extension ecosystems. Cursor, a maker of AI-assisted developer tools, relies on a marketplace model where extensions are distributed through official accounts. The compromise of Anthropic’s official account demonstrates that even trusted vendors are vulnerable to supply-chain attacks if their distribution channels are breached.

Previous incidents in the developer tools space have shown that extension marketplaces can be vectors for malware distribution. For example, similar attacks have targeted Visual Studio Code extensions in the past, leading to widespread infections. The fact that this attack targeted an official account of a major AI provider like Anthropic underscores the need for robust security measures in extension distribution channels.

What it means for developers

Developers who installed or updated Anthropic’s VS Code extension from Cursor between 5:27 am ET and 4:35 pm on Thursday should consider themselves affected. It may be wise for anyone who has recently done so to also consider themselves potentially infected. Users should check for indicators of compromise, such as unexpected SSH keys, enabled SSH services, or reverse tunnels. Additionally, developers should review their cloud credentials and API tokens for any signs of unauthorized access.

To mitigate future risks, developers should consider disabling auto-updates for extensions and manually verifying updates before installation. Organizations should implement stricter access controls for their extension marketplaces and regularly audit their distribution channels for potential compromises. Security teams should monitor for signs of supply-chain attacks and have incident response plans in place to quickly respond to such threats.

What to watch

• Anthropic’s public response: It remains unclear why Anthropic isn’t publicly warning customers of the threat. A public statement from Anthropic would provide clarity on the incident and reassure users.
• Explanation of the breach: Neither Anthropic nor Cursor has explained how the supply-chain compromise happened. Understanding the root cause is crucial for preventing similar attacks in the future.
• Further infections: Monitor for any additional reports of infections or follow-up attacks by the same threat actor. The initial reconnaissance phase suggests that the attacker may be planning further actions.
• Marketplace security improvements: Watch for any security improvements or policy changes from Cursor and other extension marketplaces to prevent similar compromises.