Anthropic Claude Extension Backdoor Exposed Up to 5,000 Cursor Developers

Summary

Anthropic’s official Claude VS Code extension on Cursor was backdoored on October 29, potentially affecting at most 5,000 users. Malicious version 2.1.313 replaced 2.1.312 through Anthropic’s official account from 5:27 a.m. to 4:35 p.m. Eastern; Cursor enables extension auto-updates by default, although users can disable them. Anthropic released version 2.1.314 several hours later, independent researcher Kevin Beaumont found. Phorian CTO and co-founder Luke Roberts confirmed the supply-chain compromise, but Anthropic and Cursor have not explained how attackers seized the account or answered related questions. Anthropic has issued no public customer warning.

Built for Windows, macOS and Linux, the malware collected hostnames, usernames, operating systems, architecture, home paths, environment-variable names, working directories, configured Git emails and public IPs. Running with Cursor’s Integrated Development Environment permissions, it could access local files, source code and developer tools. It attempted to add an attacker-controlled key to authorized_keys, enable SSH and create a reverse tunnel, with persistence through a macOS LaunchAgent or a Windows scheduled task running as SYSTEM with a Startup-script fallback. Scripts retried about every 60 seconds and reported reconnaissance and backdoor status by HTTP POST to /beacon on port 8099. Phorian said environment-variable names could identify machines holding cloud credentials or API tokens. Coding errors caused the SSH stage to fail without unusual administrator privileges and disrupted some Windows and macOS infections, but the malware could still establish persistence and beacon.

Cursor removed version 2.1.313, blocked further distribution and worked with the command server’s cloud provider to prevent infected devices connecting. It temporarily closed the VSCode Marketplace to rotate keys, audit access controls and verify no other extensions were compromised; the marketplace has reopened. Anyone who installed or updated during the exposure window should consider themselves affected, while recent installers may also be at risk. Cursor and Phorian have published compromise indicators, including IP addresses and cryptographic hashes.