Anthropic VS Code Extension on Cursor Backdoored for Nearly 12 Hours

Multiple sources reported that an official VS Code extension for Anthropic's Claude model distributed via the Cursor marketplace was compromised by a malicious update, potentially affecting up to 5,000 developers' machines for nearly 12 hours. As of Friday, Anthropic had not issued a public warning to customers regarding the incident.

According to independent researcher Kevin Beaumont and security firm Phorion, the malicious version 2.1.313 was distributed through Anthropic's official account on Cursor. Cursor stated that the update became available on Thursday and was subsequently superseded by version 2.1.314 hours later. Neither company has publicly explained how the attackers gained control of the official account.

Backdoor Capabilities and Impact

Cursor reported that the compromised extension attempted to establish persistent remote access and gather host information. According to security analyses, the code targeted Windows, macOS, and Linux environments, operating with the permissions of the tool's Integrated Development Environment to potentially access local files and developer tooling.

Reported capabilities and technical actions include:

• Collecting host and user details, such as usernames, operating systems, environment variable names, working directories, and public IP addresses.
• Attempting to append an attacker-controlled SSH key to `authorized_keys`, enable local SSH services, and open a reverse SSH tunnel.
• Configuring persistence mechanisms via macOS LaunchAgents or Windows scheduled tasks and startup scripts, with background scripts retrying approximately every 60 seconds.
• Transmitting host reconnaissance data via HTTP POST requests to a specified beacon endpoint.

Phorion noted that while bugs in the malicious code prevented successful execution in certain scenarios—such as failing to establish the SSH key addition without administrator privileges—the malware still presented a significant reconnaissance threat by gathering environment variable names that could expose cloud credentials and API tokens.

Mitigation and Response

Cursor personnel reportedly coordinated with the hosting provider of the reverse shell server to block connectivity from infected devices, removed the compromised version from the marketplace, and temporarily shut down the VS Code Marketplace to rotate keys and audit access controls.

• Affected Timeframe: Developers who installed or updated the extension between 5:27 am ET and 4:35 pm on Thursday are advised to consider themselves potentially affected.
• Verification: Users can review indicators of compromise, including specific cryptographic hashes and IP addresses provided by Cursor and Phorion.
• Unanswered Questions: It remains unclear why Anthropic has not publicly warned customers or detailed the root cause of the supply-chain breach, as neither company responded to press inquiries.