An official extension for Anthropic's Claude model was compromised and left as many as 5,000 developers at risk after a malicious update hit the Cursor marketplace for nearly 12 hours on Friday. Ars Technica reports that version 2.1.313 of the VS Code extension was distributed directly through Anthropic's official account.
Key takeaways
- An official Anthropic extension on Cursor received a malicious update that threatened thousands of developers.
- The compromised version 2.1.313 was available for nearly 12 hours before being replaced by version 2.1.314.
- Cursor stated that the code attempts to install a persistent SSH backdoor across Windows, macOS, and Linux.
- Anthropic has not yet issued a public warning or customer notice regarding the security breach.
How did the Cursor extension backdoor happen?
Independent researcher Kevin Beaumont and Phorian CTO and co-founder Luke Roberts both confirmed that version 2.1.313 went out through the official Anthropic account on Cursor. Roberts described the event to Ars Technica, stating, It was a supply-chain compromise where the attacker gained access to the official distribution channel. Cursor extensions update automatically by default unless users change their settings.
Neither Cursor nor Anthropic has explained how attackers managed to control the account. Anthropic released version 2.1.314 several hours after the malicious package first appeared.
What threats does the malicious Anthropic Claude model package pose?
Cursor explained that the malicious code tries to install a persistent SSH backdoor by adding an attacker-controlled SSH key, enabling local SSH services, and opening a reverse SSH tunnel. Because these tools run with Integrated Development Environment permissions, the software likely accessed local files, source code, and other developer tools.
What happens next for affected users?
Up to 5,000 users were affected when they downloaded the package or their systems automatically fetched it. Affected machines run Windows, macOS, and Linux. While Anthropic has yet to notify customers directly, developers using these environments need to check their local configurations and SSH keys for unauthorized modifications.
Frequently asked questions
It was a security incident where malicious version 2.1.313 of an official Anthropic extension was distributed through the official account on Cursor, threatening developer machines with unauthorized access for nearly 12 hours.
As many as 5,000 developers running Windows, macOS, and Linux who downloaded or automatically fetched the compromised VS Code extension version on Cursor were affected.
The malicious version 2.1.313 was posted directly through Anthropic's official account on Cursor, superseding version 2.1.312 and deploying automatically to users with default extension update settings.
According to Cursor, the malicious extension attempted to install a persistent SSH backdoor by adding an attacker-controlled SSH key, enabling local SSH services, and opening a reverse SSH tunnel.
Multiple sources reported that Anthropic has yet to issue public notice or warn customers of the incident, though they pushed a newer version 2.1.314 several hours later.
Based on reporting by Ars Technica. Read the original article
