Cursor’s Anthropic VS Code Extension Compromised by Backdoor for Nearly 12 Hours

An alarming security breach involving an official extension for Anthropic’s Claude model has put nearly 5,000 developers at risk. Multiple reports emerged on Friday highlighting the issue, which Anthropic has yet to formally address with its customer base.

The vulnerability originated from a Visual Studio Code (VS Code) extension available on Cursor, a platform known for AI-assisted developer tools. The compromised version, identified as 2.1.313, had the potential to impact “at most 5,000 users” who either downloaded it directly or had it automatically installed through their systems. In response to the threat, Anthropic released a secured version, 2.1.314, only hours after the malicious extension became available, as pointed out by independent researcher Kevin Beaumont.

Understanding the Breach

Both Beaumont and Luke Roberts, CTO and co-founder of security firm Phorion, confirmed that the malicious extension was distributed via Anthropic’s official account on Cursor. To date, neither Cursor nor Anthropic has provided clarity on how their account was compromised.

Supply Chain Compromise

Roberts explained to Ars that the incident represents a supply-chain compromise, where the assailant accessed the official distribution channel. The malicious version 2.1.313 replaced the previous version, 2.1.312, and it is noteworthy that extensions are set to auto-update by default in Cursor, although users can modify this feature in their settings.

Despite the severity of the incident, Anthropic has not yet made a public announcement to inform affected customers. Meanwhile, Cursor reported that the harmful extension seeks to install a persistent SSH backdoor by adding an unauthorized SSH key, activating the local SSH service, and establishing a reverse SSH tunnel. This malicious code is operable across multiple platforms, including Windows, macOS, and Linux. Given that Cursor extensions operate with the permissions of the Integrated Development Environment (IDE), the backdoored version could potentially access local files, source code, and other developer tools once installed.