What We Know About the Backdoored Anthropic VS Code Extension

An official Anthropic extension for its Claude model was replaced with a backdoored version on the Cursor developer marketplace for close to 12 hours, exposing as many as 5,000 developers to a persistent SSH backdoor, according to Ars Technica, which cited multiple security researchers.

What happened to the Anthropic extension on Cursor?

The compromised package was version 2.1.313 of Anthropic's extension, distributed through what independent researcher Kevin Beaumont and Phorian co-founder Luke Roberts both identified as Anthropic's verified account on the Cursor marketplace, Ars Technica reported. Anthropic pushed a clean version, 2.1.314, several hours after the malicious build appeared, according to Beaumont. "It was a supply-chain compromise where the attacker gained access to the official distribution channel," Roberts told Ars Technica. "The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312."

How many developers were affected?

Cursor said the malicious version affected "at most 5,000 users," likely those who either downloaded the update manually or had it installed automatically, since Cursor extensions auto-update by default unless a user changes that setting, per the report.

What could the backdoor do?

Cursor said the code, built to run on Windows, macOS, and Linux, attempted to add an attacker-controlled SSH key to a device's authorized_keys file, enable the local SSH service, and open a reverse SSH tunnel back to the attacker. It also tried to make that tunnel persistent through a macOS LaunchAgent or a Windows scheduled task running as SYSTEM, with background scripts retrying the connection roughly every 60 seconds and reporting status to an external server on port 8099, according to Cursor's account cited by Ars Technica. The malware also collected hostname, username, operating system, architecture, home-directory path, environment-variable names, working directories, Git email, and public IP address. Roberts told Ars Technica that harvesting environment-variable names let the attacker quickly inventory cloud credentials and API tokens on a compromised machine, likely to prioritize follow-up targets. Because Cursor extensions run with the same permissions as the development environment itself, the backdoor would have had access to local files, source code, and developer tooling, the outlet reported. Ars Technica noted that bugs in the Windows and macOS code meant the SSH-key step would generally fail outside unusual cases where Cursor was launched with administrator privileges.

How did attackers gain access to the account?

Neither Cursor nor Anthropic has explained how the attacker obtained control of Anthropic's verified distribution account, according to Ars Technica. As of the report, Anthropic had not issued a public notice to customers about the incident.

What should developers do now?

Ars Technica's reporting points developers toward checking which extension version is installed, reviewing authorized_keys files and scheduled tasks or LaunchAgents for unfamiliar entries, and rotating any cloud credentials or API tokens that may have been exposed on affected machines. Phorian published additional technical detail on the incident, referenced in the Ars Technica story, for teams conducting their own forensic review.

AlterEgo — A keyboard for character voices. Five free persona rewrites a day.