Malicious update to Anthropic's Cursor extension hit up to 5,000 developers

An official VS Code extension for Anthropic’s Claude, distributed through the marketplace of AI coding tool Cursor, was compromised by attackers and left live for nearly 12 hours this week, exposing as many as 5,000 developers’ machines to a backdoor, multiple sources reported Friday.

Cursor said the malicious version, numbered 2.1.313, replaced the legitimate 2.1.312 and was posted through Anthropic’s own official account on the marketplace, according to independent researcher Kevin Beaumont and Luke Roberts, CTO and co-founder of security firm Phorian. Because Cursor extensions update automatically by default, many users would have received the tainted version without taking any action. Anthropic pushed a fixed version, 2.1.314, several hours later. Neither company has said how the attacker gained control of Anthropic’s distribution account, and Anthropic has not issued a public notice to customers about the incident.

Cursor said the backdoored extension, which was written to run on Windows, macOS, and Linux, first collects information about the host machine: hostname, username, operating system, architecture, home directory path, environment variable names, working directories, a configured Git email address, and the device’s public IP. It then attempts to add an attacker-controlled SSH key to the machine’s authorized keys file, turn on the local SSH service, and open a reverse SSH tunnel back to the attacker. Cursor said this step would normally fail unless the application was running with administrator privileges, due to errors in the malicious code. The extension also tries to make that tunnel persistent, using a LaunchAgent on macOS or a scheduled task on Windows that attempts to run as SYSTEM, with background scripts retrying the connection roughly every 60 seconds. Infected machines report their status back to the attacker via an HTTP request to a server on port 8099.

Roberts said the theft of environment variable names would have let the attacker quickly spot which infected machines held cloud credentials or API tokens, likely to prioritize targets for further attacks. Despite coding flaws that stopped the backdoor from working in some cases on Windows and macOS, Phorian said the malware still “installs persistence and beacons host reconnaissance back to the operator.”

Cursor said it worked with the cloud provider hosting the attacker’s server to cut off infected devices’ access to it, removed the backdoored extension from the marketplace, and blocked further distribution. The company also temporarily shut down its extension marketplace to rotate security keys, audit access controls, and check that no other extensions had been tampered with. The marketplace has since reopened.

Cursor and Phorian have each published indicators of compromise, including IP addresses and file hashes, for developers to check against their own systems. Anyone who installed or updated Anthropic’s extension on Cursor between 5:27 am and 4:35 pm ET on Thursday should treat their machine as potentially affected. What remains open is why Anthropic has not told customers directly and why neither company has detailed how the attacker got into Anthropic’s marketplace account in the first place.