Backdoored Anthropic VS Code extension distributed through Cursor marketplace

Independent researchers say version 2.1.313 was published through Anthropic's official account on Cursor, and it replaced the earlier 2.1.312 build. Anthropic released version 2.1.314 several hours later. Ars Technica reports that the company has not issued a public notice to customers, and that neither Cursor nor Anthropic answered questions about how the account was compromised.

Cursor says the extension tries to add an attacker-controlled SSH key, enable the local SSH service and open a reverse SSH tunnel, with persistence through a LaunchAgent on macOS or a scheduled task on Windows. It also sends host details, including username, operating system and environment variable names, to a server over HTTP. Bugs in the code prevent the backdoor from working in some cases, but researchers still call it a significant threat.

Cursor removed the backdoored version, blocked further distribution and shut down the VSCode Marketplace briefly to rotate keys and audit access controls, and says no other extensions were compromised. Ars Technica says anyone who installed or updated the extension through Cursor between 5:27 am ET and 4:35 pm on Thursday should consider themselves affected. Both companies have published indicators of compromise, including IP addresses and file hashes.

Teams running Claude extensions in Cursor should check installed versions, review auto-update settings and look for unexpected SSH keys or tunnels on any machine that updated during the affected window. Installing the newer version does not clear an infection that already happened, so affected machines need a separate review of credentials. Extensions in an IDE run with that IDE's permissions, so a compromised extension can reach local files, source code and stored cloud tokens.