A backdoored Claude extension sat on Cursor's marketplace for about 11 hours, hitting up to 5,000
What happened
Version 2.1.313 of Anthropic's official Claude extension was published on Cursor's VS Code marketplace on Thursday at 5:27 am ET. It tried to plant a persistent SSH backdoor on developer machines, and Cursor says at most 5,000 users were affected. Anthropic released a clean version, 2.1.314, several hours later, and Cursor pulled the malicious build. Neither company has said how the attacker took over Anthropic's publishing account, and Ars Technica reports Anthropic had issued no public notice to customers.
What we know
- Cursor said the malicious build, 2.1.313, reached at most 5,000 users; Wired puts the exposure at roughly 5,000 developer machines (per Ars Technica and Wired).
- Per Ars Technica, anyone who installed or updated the extension from Cursor between 5:27 am and 4:35 pm ET on Thursday should treat their machine as affected. That window is about 11 hours.
- Cursor said the code tried to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel on Windows, macOS and Linux. It also sent host details to the attacker's server (per Ars Technica).
- Cursor said coding errors made the SSH-key step fail unless Cursor was running with administrator privileges, and Wired reports flawed code kept the attacker from fully compromising machines. Security firm Phorian still called the malware a significant threat because it installs persistence and sends reconnaissance to the operator (per Ars Technica).
- Cursor worked with the cloud host of the attacker's server to cut off infected devices, removed the bad version, and briefly shut the marketplace to rotate keys and audit access (per Ars Technica).
What we don't know yet
- How the attacker gained control of Anthropic's official account on the Cursor marketplace; neither Cursor nor Anthropic answered Ars Technica's questions on this.
- Whether the attacker's server collected data from enough machines to run follow-up attacks. Phorian said the collected environment-variable names let the operator inventory cloud credentials and API tokens, but no confirmed downstream intrusions were reported in the sources.
- Whether any other extension or marketplace was affected. Cursor said it is auditing this, and no result is published in the sources.
- Why Anthropic had not publicly warned customers when Ars Technica published.
Why it matters
Developers who installed or auto-updated the Claude extension in Cursor during the window may have exposed local source code, cloud credentials and API tokens, and they need to rotate secrets and check for the attacker's SSH key. The incident also shows that a hijacked publisher account on an official marketplace can push malware to auto-updating IDE users within hours.
Claims
- ConfirmedVersion 2.1.313 of Anthropic's Claude VS Code extension, distributed through Anthropic's official account on Cursor's marketplace, was malicious.
- ConfirmedCursor said the malicious version affected at most 5,000 users.
- ConfirmedUsers who installed or updated the extension from Cursor between 5:27 am and 4:35 pm ET on Thursday are considered affected.
- ConfirmedPer Cursor, the malicious code attempted to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel.
- ConfirmedPer Cursor, bugs in the malicious code made the SSH-key step fail unless Cursor was started with administrator privileges.
- ConfirmedAnthropic released version 2.1.314 several hours after the malicious version appeared, per researcher Kevin Beaumont.
- ConfirmedAs of Ars Technica's report, Anthropic had not publicly warned customers about the incident.
- UnconfirmedThe attacker's collection of environment-variable names was used to prioritize machines holding cloud credentials for follow-up attacks.
Related coverage
Why you can trust this story
68%Source map · 2 outlets / 2 articles
- Ars Technica
- Article 1arstechnica.comreport
- Wired
- Article 1wired.comreport
How this credibility score is calculated
- Source reliability
- Corroboration
- Primary source
- Claims checked against the source
- No contradiction
- Settled
- Claim attribution
- AI disclosure
Checked claims were verified against the cited source text. Weights are fixed and explainable.
Human accountability
- 2 independent origins / 2 sources
- Drafted by an automated system; a human editor approves every story before it is published.
Verification ledger · 8
- Claim: Version 2.1.313 of Anthropic's Claude VS Code extension, distributed through Anthropic's official account on Cursor's marketplace, was malicious.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: Cursor said the malicious version affected at most 5,000 users.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: Users who installed or updated the extension from Cursor between 5:27 am and 4:35 pm ET on Thursday are considered affected.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: Per Cursor, the malicious code attempted to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: Per Cursor, bugs in the malicious code made the SSH-key step fail unless Cursor was started with administrator privileges.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: Anthropic released version 2.1.314 several hours after the malicious version appeared, per researcher Kevin Beaumont.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: As of Ars Technica's report, Anthropic had not publicly warned customers about the incident.Status: ConfirmedVerification trailVerifiedChecked by verification engine
At least one checkable detail was matched against the full text of the cited source.
- Claim: The attacker's collection of environment-variable names was used to prioritize machines holding cloud credentials for follow-up attacks.Status: UnconfirmedVerification trailUnverifiedChecked by verification engine
No automated check against the source text is available.
Update log · 0
AI accelerates. High-risk topics wait for a human editor.