Anthropic Cursor Extension Backdoored for 12 Hours

Anthropic Cursor extension backdoor supply chain attack

An official Visual Studio Code extension for Anthropic's Claude model got compromised and pushed out through the company's verified Cursor account for nearly twelve hours Thursday, potentially hitting as many as five thousand developers with a persistent backdoor. The malicious version, 2.1.313, swapped in for the legitimate 2.1.312 release and auto-updated anyone who hadn't turned off Cursor's default behavior. Anthropic shipped a clean 2.1.314 a few hours later, but neither they nor Cursor have explained how the publishing account was taken over.

Researchers confirm official Anthropic account compromised

Security researchers at Phorian and independent analyst Kevin Beaumont confirmed the bad extension came straight from Anthropic's own Cursor account, making this a supply-chain attack, not a typosquat or impersonation. According to Phorian co-founder and CTO Luke Roberts, the payload installed an attacker-controlled SSH key, fired up the local SSH service, and opened a reverse tunnel for remote access. Since Cursor extensions run with the same permissions as the IDE itself, a successful install handed over local files, source repos, and dev tooling across Windows, macOS, and Linux.

Backdoor capabilities beyond remote access

The backdoor did more than just remote access. It vacuumed up hostnames, usernames, OS details, architecture, home directory paths, environment variable names, working directories, Git emails, and public IPs. Phorian noted that grabbing env var names let the attacker quickly inventory cloud creds and API tokens, likely to prioritize high-value targets. The malware also tried to persist via LaunchAgents on macOS and scheduled SYSTEM tasks on Windows, with background scripts retrying the tunnel roughly every sixty seconds. Status updates and recon data posted via HTTP to a beacon on port 8099.

Coding errors in the Windows and macOS implementations stopped the SSH tunnel from establishing in many cases, mostly because the extension usually lacks admin rights. Still, Phorian stressed the malware planted persistence mechanisms and successfully exfiltrated host recon data, a real threat even in a flawed state. Cursor worked with the cloud provider hosting the C2 to cut connectivity for infected machines, yanked the malicious version, and temporarily shut down the VS Code Marketplace to rotate keys, audit access, and verify no other extensions were touched. The marketplace is back open now.

The incident window runs from 5:27 a.m. to 4:35 p.m. Eastern Thursday, though anyone who installed or updated recently should treat their system as potentially compromised. Critically, updating to the clean 2.1.314 doesn't remove an established backdoor; the persistence stays unless you manually clean it. Both Cursor and Phorian have published IOCs, including IPs and hashes, to help detection.

Anthropic silent on compromise cause and delayed disclosure

As of Friday, Anthropic hasn't issued a public notice to customers, and neither company has answered how the publishing account was compromised or why disclosure was delayed. For developers building with AI-assisted tooling, the episode underscores the risk of trusting auto-updates from even verified vendor accounts. Anyone who used the Anthropic extension on Cursor during the exposure window should immediately audit for the published indicators, rotate any credentials in env vars or config files, and treat the compromise as a potential gateway to broader infrastructure access.

Frequently asked questions

What happened to the Anthropic Cursor extension on Thursday?

The official Visual Studio Code extension for Anthropic's Claude model was compromised and distributed through Anthropic's verified Cursor account for nearly 12 hours. Malicious version 2.1.313 replaced legitimate version 2.1.312 and auto-updated users who hadn't disabled Cursor's default auto-update behavior, potentially affecting up to 5,000 developers.

How did the malicious extension get distributed to developers?

The compromised extension was published directly from Anthropic's own verified Cursor account, making this a supply-chain attack rather than typosquatting or impersonation. Security researchers at Phorian and Kevin Beaumont confirmed the malicious version 2.1.313 originated from the legitimate vendor account.

What data did the backdoor steal from infected systems?

The malware exfiltrated hostnames, usernames, OS details, architecture, home directory paths, environment variable names, working directories, Git emails, and public IPs. Capturing environment variable names allowed the attacker to inventory cloud credentials and API tokens to prioritize high-value targets.

Does updating to version 2.1.314 remove the backdoor?

No. Updating to the clean 2.1.314 release does not remove an established backdoor. The persistence mechanisms-LaunchAgents on macOS and scheduled SYSTEM tasks on Windows-remain on the system unless manually cleaned. The malware retried its reverse tunnel roughly every 60 seconds.

What should developers who used the extension during the exposure window do?

Immediately audit systems for published indicators of compromise (IPs and hashes) from Cursor and Phorian, rotate any credentials stored in environment variables or config files, and treat the compromise as a potential gateway to broader infrastructure access. The incident window ran from 5:27 a.m. to 4:35 p.m. Eastern Thursday.

Source: Ars Technica