A compromised version of Anthropic’s official VS Code extension sat on Cursor’s marketplace for nearly 12 hours before anyone caught it, and in that window it may have planted a backdoor on as many as 5,000 developers’ computers. The incident is a sharp reminder that even verified, officially distributed developer tools aren’t automatically safe, especially when they auto-update by default.
What actually happened
Cursor, the AI-assisted coding tool, confirmed that a malicious build of Anthropic’s Claude extension, version 2.1.313, was distributed through Anthropic’s own verified account on its marketplace. According to independent researcher Kevin Beaumont and security firm Phorian, that version silently replaced the legitimate 2.1.312 release. Because Cursor extensions auto-update unless a user turns that off, anyone with the extension installed could have received the bad version without doing anything at all. Anthropic pushed a fixed version, 2.1.314, several hours later, but neither company has explained how attackers gained control of the official account in the first place.
What the backdoor actually did
Cursor’s own breakdown of the malicious code describes a fairly standard, if effective, reconnaissance-and-persistence playbook. The extension collected detailed host information, including hostname, username, operating system, architecture, home directory path, environment variable names, working directories, configured Git email and public IP address. Phorian noted that harvesting environment variable names in particular would let an attacker quickly spot which machines had valuable cloud credentials or API tokens stored locally, useful for prioritizing follow-up attacks.
Beyond data collection, the code tried to add an attacker-controlled SSH key to the system’s authorized keys, enable the local SSH service, and open a reverse SSH tunnel back to infrastructure the attacker controlled. It then attempted to make that tunnel persistent through a macOS LaunchAgent or a Windows scheduled task, retrying roughly every 60 seconds, and reported status back to an external server over HTTP. Because Cursor extensions run with the same permissions as the IDE itself, a working backdoor could reach local files, source code and other developer tooling.
Why it wasn’t worse (for now)
The malware contained bugs. Phorian found that errors in the Windows and macOS code meant the SSH persistence step would fail in most normal setups, short of Cursor being run with administrator privileges, something that’s unusual. That doesn’t make the incident harmless. Phorian still described it as “a significant threat that installs persistence and beacons host reconnaissance back to the operator,” since the reconnaissance and tunnel-opening attempts ran regardless of whether persistence ultimately succeeded.
Cursor says it worked with the cloud provider hosting the attacker’s server to cut off access for already-infected machines, pulled the backdoored version from the marketplace, and temporarily shut down the entire VS Code Marketplace to rotate keys, audit access controls and check whether any other extensions were tampered with. The marketplace is back online now.
What developers should do
Anyone who installed or updated Anthropic’s VS Code extension on Cursor between 5:27 a.m. ET and 4:35 p.m. ET on Thursday, October 29, should treat their machine as potentially affected. Updating to the fixed version does not remove an existing infection, since the backdoor code and any added SSH key would still be present on a compromised system. Cursor and Phorian have both published indicators of compromise, including IP addresses and file hashes, that developers can check against. If you fall in that window, it’s worth reviewing your authorized_keys file for unfamiliar entries, checking for unexpected scheduled tasks or LaunchAgents, and rotating any cloud credentials or API tokens that were accessible on the machine.
What’s notably missing is direct customer communication. As of this report, Anthropic had not issued a public notice to users about the incident, and neither company would explain how the attacker got into the official distribution account to begin with.
The bottom line
This wasn’t a flaw in Claude itself, it was a breach of the account used to publish Anthropic’s extension, and it shows how a single compromised publisher credential can turn an auto-updating tool into an attack vector overnight. The coding bugs in the malware likely limited real-world damage, but the reconnaissance data collection still worked. If you run Cursor with Anthropic’s extension installed, check whether you updated during the affected window, review your system for the listed indicators of compromise, and rotate any credentials that were sitting on that machine, regardless of whether you think you’re in the clear.
Source: Ars Technica
