Claude extension backdoored on Cursor marketplace for nearly twelve hours

The official Claude extension for VS Code was backdoored on Cursor's marketplace for nearly twelve hours last week, exposing as many as 5,000 developers to an SSH backdoor — and Anthropic, the company that sells "AI safety" as its founding brand, has not warned a single customer.

The compromised package, version 2.1.313, was distributed through Anthropic's own official account on Cursor, according to both independent researcher Kevin Beaumont and Luke Roberts, CTO of security firm Phorion. It superseded the legitimate 2.1.312 and auto-installed by default for users of the AI-assisted development tool. Neither Cursor nor Anthropic has explained how attackers gained control of the official distribution channel.

The malicious code was cross-platform, written to run on Windows, macOS and Linux. According to Cursor's own incident report, it collected host and user information — hostname, username, OS, architecture, home directory, environment variable names, working directories, Git email and public IP — and attempted to add an attacker-controlled SSH key, enable the local SSH service, and open a reverse tunnel, made persistent via a LaunchAgent on macOS or a scheduled task on Windows, retrying roughly every sixty seconds and reporting status to the operator over HTTP.

Phorion noted that the theft of environment variable names let the operator inventory cloud credentials and API tokens on each compromised machine — effectively a triage step for prioritising follow-up attacks. Because Cursor extensions inherit the IDE's permissions, a developer who installed the update handed the attacker access to local files, source code and tooling in one motion.

The damage was limited partly by the attacker's own incompetence: bugs in the Windows and macOS code prevented the SSH persistence step from working outside unusual circumstances. Cursor staff worked with the cloud provider hosting the reverse-shell server to cut off infected devices, pulled the extension, and shut the entire marketplace briefly to rotate keys and audit for other compromises.

What remains unexplained is the silence. Ars Technica reports that Anthropic has issued no public notice of the incident and that neither company answered questions about how the supply-chain compromise occurred. The lesson is not that Anthropic is uniquely careless — it is that any vendor's distribution pipeline, however safety-branded, is a single point of failure, and that AI agents holding developer credentials multiply the blast radius of every such failure.

The backdoored extension was distributed through the account of a company whose entire commercial pitch is that its models can be trusted.