An official extension for Anthropic’s Claude model was backdoored and threatened as many as 5,000 developers’ machines, multiple sources reported Friday. Anthropic so far has yet to warn customers of the incident.

The compromised package was a VS Code extension available in the marketplace of Cursor, a maker of AI-assisted developer tools, the company said Friday. The malicious version, 2.1.313, subsequently affected “at most 5,000 users,” presumably when they either downloaded it or their systems automatically fetched and installed it. Anthropic pushed version 2.1.314 several hours after the previous version became available on Cursor, according to independent researcher Kevin Beaumont. Both Beaumont and the CTO and co-founder of security firm Phorian said that version 2.1.313 was distributed through Anthropic’s official account on Cursor. So far, neither Cursor nor Anthropic has explained how the attackers gained control of the account.

In search of cloud credentials

“It was a supply-chain compromise where the attacker gained access to the official distribution channel,” Phorian CTO and co-founder Luke Roberts told Ars. “The malicious version 2.1.313 was posted to the official Anthropic account, effectively superseding 2.1.312. Extensions auto-update in Cursor by default, but users can configure this in settings.” Phorian has more details here.

Anthropic has yet to issue public notice of the incident to customers.

Cursor said that the malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel. The code was written to work on Windows, macOS, and Linux. Because Cursor extensions run with the permissions of the tool’s Integrated Development Environment, the backdoored version likely would gain access to local files, source code, and developer tooling once it was installed.

Cursor said the capabilities of the backdoor include:

• Collecting host and user information: hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.
• Attempting to add an attacker-controlled SSH key to , enable the local SSH service, and open a reverse SSH tunnel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail.
• Attempting to make the reverse SSH tunnel persistent via a LaunchAgent (macOS) or a scheduled task that attempts to run as SYSTEM with a Startup-script fallback (Windows). Background scripts retry the tunnel roughly every 60 seconds.
• on port 8099.

Phorion said the theft of variable names allowed the operator to quickly take inventory of cloud credentials and API tokens stored on a compromised device, likely so it could prioritize which machines to target in follow-up attacks.

Bugs in the malicious code for Windows and macOS prevented the backdoor from working in some cases. Phorion said that despite the coding flaws, “the malware is still a significant threat that installs persistence and beacons host reconnaissance back to the operator.”

Cursor said company personnel worked with the cloud provider hosting the server the reverse shell connected to so that infected devices could no longer reach it. Personnel also removed the backdoored version from the marketplace and blocked further distribution. The company also shut down the VSCode Marketplace to rotate keys, audit access controls, and confirm no other extensions were compromised. The marketplace is now open.

It remains unclear why Anthropic isn’t publicly warning customers of the threat and why it and Cursor aren’t explaining how the supply-chain compromise happened. Neither company answered questions seeking this information.

Anyone who installed or updated Anthropic’s VS Code extension from Cursor between 5:27 am ET and 4:35 pm on Thursday should consider themselves affected, although it may be wise for anyone who has recently done so to also consider themselves potentially infected. Both Cursor and Phorion list various indicators of compromise, including IP addresses and cryptographic hashes.