Backdoor in Claude extension for Cursor put up to 5,000 developers at risk for nearly 12 hours

Anthropic's official VS Code extension, distributed through the Cursor editor's marketplace, contained a backdoor for almost 12 hours. According to Cursor itself, the malicious version 2.1.313 affected no more than 5000 users. It was published from Anthropic's official verified account, and neither Cursor nor Anthropic has yet explained how the attackers got access to it. Anthropic also has not issued a public warning to customers.

How version 2.1.313 reached developers' machines

Independent researcher Kevin Beaumont says Anthropic released a clean version, 2.1.314, a few hours after the malicious one appeared. Luke Roberts, CTO and co-founder of security firm Phorian, called the incident a supply-chain compromise: the attacker gained access to the official distribution channel, and 2.1.313 replaced 2.1.312. Cursor updates extensions automatically by default, although this can be turned off in settings. As a result, the code could have reached many users without a single click.

Treat as infected anyone who installed or updated the Anthropic extension in Cursor on Thursday between 5:27 and 16:35 US Eastern time. Anyone who did so shortly before that window should also be cautious. Cursor extensions run with the privileges of the IDE itself, so once installed, malicious code could access local files, source code and a developer's tools.

What the backdoor could do and where it failed

According to Cursor's description, the code works on Windows, macOS and Linux and does several things:

• collects the hostname and username, OS, architecture, home directory, environment variable names, working directories, the configured Git email and the public IP;
• tries to add the attacker's SSH key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel;
• persists the tunnel through a LaunchAgent on macOS, or through a scheduled task with SYSTEM privileges plus a fallback startup script on Windows; background scripts retry roughly once every 60 seconds;
• sends data about the host and the backdoor's status to /beacon on port 8099 via an HTTP POST request.

Phorian estimates that collecting environment variable names is meant for a quick inventory of cloud keys and API tokens on the machine. The operator probably used it to pick which devices to attack next. The description does not mention the variable values themselves.

The code was buggy, though. According to Cursor, the SSH key and tunnel step failed everywhere except in rare cases where the editor was running with administrator privileges. Bugs in the Windows and macOS versions in some cases kept the backdoor from working at all. Phorian still considers the malware a serious threat: it persists on the system and sends the operator reconnaissance data about the host.

Cursor's response and what users should do

Cursor contacted the cloud provider whose server hosted the reverse shell listener, and infected devices can no longer reach it. The malicious version was removed from the marketplace and blocked from further distribution. The VSCode marketplace was temporarily shut down while the company rotated keys, reviewed access controls and confirmed that other extensions had not been compromised. It is now open again.

Two questions remain unanswered: how exactly Anthropic's account was compromised, and why the company is not warning customers. Neither Anthropic nor Cursor responded to requests from Ars Technica.

Practical takeaways for anyone who fell within the window: check the indicators of compromise (IP addresses and cryptographic hashes) in the Cursor and Phorian publications. Inspect authorized_keys, LaunchAgents and scheduled tasks for traces of a foreign SSH key and tunnel. If in doubt, reissue the cloud keys and API tokens that were stored on the machine. Simply updating to 2.1.314 does not, judging by the description of the persistence mechanisms, remove the malicious entries from the system. This is a conclusion drawn from that description, not a fact confirmed by the vendors. Separately, consider disabling extension auto-updates in work environments that hold valuable secrets.