Anthropic VS Code extension on Cursor backdoored for nearly 12 hours
Original title: Anthropic VS code extension on Cursor backdoored for nearly 12 hours
Version 2.1.313, published on Anthropic’s official Cursor account, tried to install a persistent SSH backdoor on up to 5,000 machines.
A malicious build of Anthropic’s official Claude VS Code extension, version 2.1.313, was published through Anthropic’s account on the Cursor marketplace and superseded 2.1.312. Cursor said the package tried to add an attacker-controlled SSH key, enable local SSH, and open a reverse tunnel on Windows, macOS, and Linux. Anthropic later published 2.1.314. The report says Anthropic has not publicly explained the account compromise or warned customers.
Unconfirmed: Neither company has explained how the official account was taken over, and the 5,000-user figure is an upper bound.
- Cursor said at most 5,000 users downloaded or auto-installed version 2.1.313.
- Cursor extensions auto-update by default unless users change that setting.
- The backdoor code was written for Windows, macOS, and Linux.
- IDE permissions would expose local files, source code, and developer tools.
- Kevin Beaumont said Anthropic published 2.1.314 several hours later.
Impact: Persistent SSH access to developer files, source code, and tooling
| Product | Affected | Fixed in |
|---|---|---|
| Anthropic Claude VS Code extension | 2.1.313 | 2.1.314 |
- 1.Replace extension version 2.1.313 with 2.1.314.
- 2.Check hosts for unexpected SSH keys and reverse SSH tunnels.
- 3.Review Cursor’s extension auto-update setting.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1098.004 SSH Authorized KeysT1021.004 SSHT1572 Protocol Tunneling
- Products
- Claude VS Code extension
- Organizations
- Phorian
- AI models
- Claude
From the original article
1 min read at arstechnica.com
It's still unknown how attackers got access to Anthropic's verified Cursor account.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.