An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday. Anthropic has not yet warned customers about the incident.
Compromised Official Account
The compromised package was a VS Code extension available in the marketplace of Cursor, a developer tool maker, as announced by the company on Friday. The malicious version, labeled 2.1.313, affected up to 5,000 users after being downloaded or automatically installed by their systems. Independent researcher Kevin Beaumont reported that Anthropic pushed version 2.1.314 several hours after the problematic version appeared on Cursor. Beaumont, alongside Phorian CTO and co-founder Luke Roberts, confirmed that version 2.1.313 was distributed directly through Anthropic’s official Cursor account. Neither Anthropic nor Cursor has explained how attackers managed to control the account.
Describing the incident to Ars Technica, Roberts stated, “It was a supply-chain compromise where the attacker gained access to the official distribution channel.” He added that the malicious update superseded version 2.1.312 and noted that extensions auto-update by default in Cursor unless changed in settings.
Backdoor Capabilities
Cursor reported that the malicious software attempted to install a persistent SSH backdoor by introducing an attacker-controlled SSH key, enabling the local SSH service, and launching a reverse SSH tunnel. The code was designed to operate across Windows, macOS, and Linux platforms. Because Cursor extensions execute with the permissions of the Integrated Development Environment, the compromised version likely gained access to local files, source code, and developer tools upon installation.
Anthropic has not yet issued a public notification to customers regarding the security breach.
