Anthropic's Claude VS Code extension on Cursor was compromised for nearly 12 hours Thursday, affecting as many as 5,000 developers. The malicious version 2.1.313 installed a persistent SSH backdoor on Windows, macOS, and Linux machines, according to Cursor and security researchers.
The attacker gained access to Anthropic's verified account on Cursor's marketplace but neither company has explained how. Anthropic pushed a patched version 2.1.314 several hours after version 2.1.313 became available, researcher Kevin Beaumont said. Extensions auto-update by default in Cursor, though users can disable this in settings.
The backdoor allowed the attacker to steal variable names containing cloud credentials and API tokens, install persistent SSH access via an attacker-controlled key, and enable reverse SSH tunnels. Cursor said the malware could access local files, source code, and developer tooling once installed because extensions run with the tool's IDE permissions.
Bugs in the malicious code for Windows and macOS prevented the backdoor from functioning in some cases. Luke Roberts, CTO and co-founder of security firm Phorian, told Ars that despite these flaws, "the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator."
Cursor removed the backdoored version from its marketplace and worked with its cloud provider to block infected devices from reaching the attacker's server. The company shut down the VSCode Marketplace temporarily to rotate keys and audit access controls.
Anyone who installed or updated the extension between 5:27 am ET and 4:35 pm Thursday should consider themselves affected. Anthropic has not yet issued a public warning to customers about the incident.