Anthropic Backdoored Claude Extension on Cursor, Exposing Up to 5,000 Users
Updated
Updated · Ars Technica · Oct 30
Anthropic Backdoored Claude Extension on Cursor, Exposing Up to 5,000 Users
3 articles · Updated · Ars Technica · Oct 30
Summary
Version 2.1.313 of Anthropic’s official Claude VS Code extension on Cursor carried malicious code and may have reached as many as 5,000 developers before a clean 2.1.314 replaced it hours later.
Cursor said the package tried to install a persistent SSH backdoor by adding an attacker-controlled key, enabling local SSH and opening a reverse tunnel across Windows, macOS and Linux.
Because Cursor extensions run with IDE permissions, the compromise likely exposed local files, source code and developer tooling on affected machines.
Researchers said the tainted release came from Anthropic’s official Cursor account, pointing to a supply-chain breach of the distribution channel; neither Anthropic nor Cursor has explained how access was obtained.
Anthropic had not publicly warned customers as of Friday, even as the incident highlighted the risk from auto-updating developer tools.