Anthropic's Claude Extension on Cursor Compromised for Nearly 12 Hours

An official VS Code extension for Anthropic's Claude model was backdoored, potentially threatening as many as 5,000 developers' machines, according to multiple reports Friday. Anthropic has not yet warned customers about the incident.

The compromised package was available in the marketplace of Cursor, an AI-assisted developer tools maker. The malicious version, 2.1.313, affected "at most 5,000 users," likely when they downloaded it or their systems automatically installed it. Anthropic released version 2.1.314 several hours after the compromised version appeared on Cursor, according to independent researcher Kevin Beaumont.

Beaumont and the CTO of security firm Phorian said version 2.1.313 was distributed through Anthropic's official account on Cursor. Neither Cursor nor Anthropic has explained how attackers gained control of the account.

"It was a supply-chain compromise where the attacker gained access to the official distribution channel," Phorian CTO and co-founder Luke Roberts told Ars. "The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings."

Cursor said the malicious extension attempts to install a persistent SSH backdoor using an attacker-controlled SSH key, enabling the local SSH service and opening a reverse SSH tunnel. The code was written to work on Windows, macOS, and Linux. Because Cursor extensions run with the permissions of the tool's Integrated Development Environment, the backdoored version likely would gain access to local files, source code, and developer tooling once installed.

Source: Ars Technica