For nearly twelve hours on Thursday, developers who use Cursor to write code with Anthropic's Claude models were downloading more than they bargained for. A malicious version of Anthropic's official Claude Code extension was distributed through Cursor's marketplace, attempting to plant a persistent backdoor on as many as 5,000 machines before the companies caught it and pulled the listing.
The compromised package, version 2.1.313, was published from Anthropic's own verified account on the Cursor marketplace, superseding the legitimate 2.1.312, independent researcher Kevin Beaumont and the security firm Phorion both reported. Because Cursor extensions auto-update by default, many affected developers never had to click anything — the malicious code arrived the moment their editor checked for updates.
Cursor said the compromised version was live from roughly 5:27 a.m. to 4:35 p.m. ET on Thursday. Anyone who installed or updated the extension during that window should consider their machine potentially compromised, the company said, even after applying the fix — the patched version does not clean up an existing infection.
A Supply-Chain Playbook
"It was a supply-chain compromise where the attacker gained access to the official distribution channel," Phorion co-founder and CTO Luke Roberts told Ars Technica. "The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings."
According to Cursor's own security notice and Phorion's technical writeup, the backdoored extension tried to add an attacker-controlled key to the machine's list of authorized SSH logins, enable the local SSH service, and open a reverse tunnel back to a server the attacker controlled — effectively a remote door into the developer's computer. Because extensions run with the same permissions as the code editor itself, a successful install would have given the attacker reach into local source code, credentials and developer tooling.
The code also collected basic reconnaissance on each machine — hostname, username, operating system, home directory path, the names (though not necessarily the values) of environment variables, configured Git email and public IP address — and phoned that information home over HTTP. Phorion said harvesting environment-variable names would let an attacker quickly spot which machines held valuable cloud credentials or API tokens worth targeting next.
Coding flaws limited how often the backdoor actually worked. Persistence mechanisms for Windows and macOS contained bugs, and the SSH service would generally only start successfully under unusual, elevated-privilege conditions. Even so, Phorion warned, "the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator."
Still No Explanation
Cursor said it worked with the hosting provider behind the attacker's server to cut off the reverse-shell connection, pulled the malicious version from the marketplace, and briefly took the entire VS Code Marketplace offline to rotate keys, audit access controls and confirm no other extensions had been tampered with. The marketplace is back online, and Anthropic shipped version 2.1.314 within hours of the compromised release going live.
What neither company has explained is how an attacker got control of Anthropic's own verified publishing account in the first place. Anthropic has not issued a public notice to customers about the incident, and neither company answered questions about the intrusion's root cause. Both Cursor and Phorion have published indicators of compromise, including IP addresses and file hashes, for developers to check their own systems against.
Security researchers have flagged the incident as part of a broader pattern: as coding assistants and AI-powered developer tools have exploded in popularity over the past two years, their extension marketplaces and plugin ecosystems have become an increasingly attractive target, since a single compromised publisher account can reach thousands of developer machines — and the credentials, source code and cloud infrastructure behind them — in one move. Developers who used the extension on Cursor during Thursday's window are being advised to rotate SSH keys and cloud credentials and check their own authorized_keys files rather than assume Friday's patch alone put things right.
