Anthropic’s official Claude model extension for Cursor was reportedly compromised, potentially exposing the machines of as many as 5,000 developers. The malicious release, version 2.1.313, was distributed through Anthropic’s official account on Cursor and reportedly installed a persistent SSH backdoor. Anthropic had not warned customers about the incident at the time of the reports.
The affected package was a VS Code extension available through the marketplace operated by Cursor, which makes AI-assisted development tools. Cursor said Friday that the malicious version may have affected “up to 5,000 users.” It may have been installed when users downloaded the extension or when Cursor automatically retrieved and installed an update.
Anthropic released version 2.1.314 hours after version 2.1.313 became available on Cursor, according to independent researcher Kevin Beaumont reported. Beaumont and Luke Roberts, co-founder and chief technology officer of security company Forian, said version 2.1.313 was distributed through Anthropic’s official Cursor account. Neither Cursor nor Anthropic has explained how the attackers gained control of the accounts.
Asking for cloud credentials
“This was a supply chain breach and the attackers had access to official distribution channels,” Roberts told Ars. “A malicious version 2.1.313 was posted on Anthropic’s official account, effectively replacing 2.1.312. By default, extensions auto-update with Cursor, but users can configure this in Settings.” Forian provided additional information about the incident in a blog post.
Anthropic had not disclosed the incident to customers.
According to Cursor, the malicious extension installs a persistent SSH backdoor with additional SSH keys controlled by the attacker, enables the local SSH service, and attempts to open a reverse SSH tunnel. The code is designed to run on Windows, macOS, and Linux.
The Cursor extension runs with the privileges of the integrated development environment. If the backdoored version was installed, it could therefore potentially access local files, source code, and developer tools.
Source: arstechnica.com
