- Published on
Anthropic VS code extension on Cursor backdoored for nearly 12 hours
- Authors
- Name
- DeepHorus
An official extension for Anthropic's Claude model was backdoored and threatened as many as 5,000 developers' machines, sources reported Friday. The compromised package was a VS Code extension available in Cursor's marketplace. The malicious version, 2.1.313, was distributed through Anthropic's official account on Cursor. Anthropic has not warned customers.
Cursor is a maker of AI-assisted developer tools. Extensions auto-update by default in Cursor, though users can configure settings. The malicious version superseded version 2.1.312. This supply-chain compromise allowed attackers to gain access to the official distribution channel.
The malicious extension attempted to install a persistent SSH backdoor using an added attacker-controlled SSH key. It enabled the local SSH service and opened a reverse SSH tunnel. The code was written to work on Windows, macOS, and Linux. Because Cursor extensions run with IDE permissions, the backdoored version likely gained access to local files, source code, and developer tooling.
The malicious version affected "at most 5,000 users," presumably when they downloaded it or their systems automatically fetched and installed it. Anthropic pushed version 2.1.314 several hours after the previous version became available. Independent researcher Kevin Beaumont and Phorian, a security firm, confirmed the distribution through Anthropic's official account.
So far, neither Cursor nor Anthropic has explained how attackers gained control of the account. "It was a supply-chain compromise where the attacker gained access to the official distribution channel," Phorian CTO and co-founder Luke Roberts told Ars. Anthropic has not issued public notice to customers. The incident highlights supply-chain risks for AI developer tools.
The compromise raises questions about security practices for AI tool distribution. Developers using Cursor are advised to review extension settings and monitor for unauthorized SSH activity. Investigations continue. The incident underscores the need for stronger verification and monitoring of extension marketplaces.
