UnconfirmedUnverifiedRating 3/5
No automated check against the source text is available.
Fact check
The attacker's collection of environment-variable names was used to prioritize machines holding cloud credentials for follow-up attacks.
Appears in
Verification ledger
- Checked by
- verification engine
- Atom checks
- 0/0
Verification held
This claim is held pending public source text we can check it against.
It will be re-verified once the cited source text is available.
Other claims in this story
- ConfirmedVersion 2.1.313 of Anthropic's Claude VS Code extension, distributed through Anthropic's official account on Cursor's marketplace, was malicious.
- ConfirmedCursor said the malicious version affected at most 5,000 users.
- ConfirmedUsers who installed or updated the extension from Cursor between 5:27 am and 4:35 pm ET on Thursday are considered affected.
- ConfirmedPer Cursor, the malicious code attempted to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel.
- ConfirmedPer Cursor, bugs in the malicious code made the SSH-key step fail unless Cursor was started with administrator privileges.
- ConfirmedAnthropic released version 2.1.314 several hours after the malicious version appeared, per researcher Kevin Beaumont.
- ConfirmedAs of Ars Technica's report, Anthropic had not publicly warned customers about the incident.
This fact check is published as schema.org ClaimReview structured data.