Anthropic: Infected Cursor Extension Exposes Up to 5,000 Users

A version of the VS Code extension linked to Claude was released via Anthropic's official account on the Cursor marketplace containing malicious code. Cursor describes an attempt at a multi-OS SSH backdoor and claims to have blocked the remote infrastructure and removed the compromised version. Up to 5,000 users may be affected, with no public explanation at this stage regarding the origin of the compromise.

Cursor blocks the malicious server and removes version 2.1.313

Cursor states that it collaborated with its cloud provider to prevent infected devices from accessing the server used by the reverse shell. The company has removed the compromised extension from its marketplace and blocked any further distribution. It also temporarily shut down the VSCode Marketplace to renew keys, audit access, and verify that no other extensions had been compromised before reopening it. According to Phorian, bugs in the Windows and macOS versions limited the backdoor's functionality in some cases, but the malicious code is still considered a threat capable of establishing persistence and transmitting reconnaissance information to the operator.

Up to 5,000 users targeted, with automatic updates by default

Cursor estimates that up to 5,000 users may have been exposed to the compromised version. Initial sources mention a risk for nearly 5,000 developers. By default, Cursor extensions update automatically, although this setting can be changed, increasing the likelihood of installing a malicious version. Anyone who downloaded or updated the Anthropic VS Code extension from Cursor between 5:27 AM ET and 4:35 PM on Thursday should consider themselves potentially affected. Cursor notes that an extension operates with the permissions of the integrated development environment, allowing access to local files, source code, and development tools as soon as it is installed. The code targeted Windows, macOS, and Linux systems.

The malware attempted an SSH backdoor and persistence every 60 seconds

Cursor reports an operation aimed at installing a persistent SSH backdoor using a key controlled by the attacker, activating the local SSH service, and setting up a reverse tunnel. The malware collected data related to the machine and user, such as the hostname, user ID, operating system, architecture, working directories, environment variables, configured Git email address, and public IP address. Cursor specifies that the integration of the SSH key and activation of the service often failed without administrative rights due to bugs in the code. Persistence was attempted via LaunchAgent on macOS or by a scheduled task as SYSTEM, accompanied by a fallback solution on Windows, with repeated attempts approximately every 60 seconds. Information about the host and the status of the backdoor was transmitted via HTTP POST to the URL /beacon on port 8099. Phorian indicates that collecting variable names allowed for a quick inventory of cloud credentials and API tokens to prioritize potential subsequent attacks.

Compromised supply chain, released versions, and gray areas

Luke Roberts, CTO and co-founder of Phorian, describes the incident as a supply chain compromise, with the attacker having access to the official distribution channel. He notes that version 2.1.313 was published on Anthropic's official account as a replacement for 2.1.312, a distribution also reported by Kevin Beaumont. The affected extension is a VS Code extension distributed on the Cursor marketplace, with the malicious version being 2.1.313, followed later by 2.1.314 according to Beaumont. Cursor and Anthropic have not explained how the account was compromised. Anthropic has not, at this stage, issued a public notice to its customers, and both companies have not responded to questions regarding the origin of the compromise or the lack of notification. Cursor and Phorian are publishing indicators of compromise, such as IP addresses and hashes, to assist in identifying affected systems.