Ars Technica reported on Friday that an official extension for Anthropic’s Claude model was compromised, potentially affecting as many as 5,000 developers.reported The incident involved a supply-chain attack where the malicious package was published through Anthropic’s official account on the Cursor marketplace. Cursor confirmed that the compromised extension, version 2.1.313, was distributed before a clean update, version 2.1.314, was pushed several hours after the previous version became available.reported It remains unclear how the attackers gained control of the official distribution channel.
The figures
- 5,000: The maximum number of users affected by the malicious extension, according to Cursor.reported
- 2.1.313: The version number of the compromised extension published on the Cursor marketplace.reported
- 2.1.314: The version number of the clean update pushed by Anthropic after the previous version became available.reported
- 12 hours: The approximate duration the backdoored extension remained available, as reported by Ars Technica.reported
Behind the figures
Independent researcher Kevin Beaumont identified the timeline of the malicious version's availability and the subsequent patch. Luke Roberts, CTO and co-founder of security firm Phorian, confirmed that version 2.1.313 was posted to the official Anthropic account, superseding the previous safe version.reported Cursor stated that extensions auto-update by default in their environment, which likely contributed to the spread. The company noted that users can configure automatic updates in their settings, potentially limiting exposure for some.
What it means for your stack
The malicious code attempted to collect host information, including hostname, username, OS architecture, and environment variables. It also tried to add an attacker-controlled SSH key to authorized_keys and enable a local SSH service. Because Cursor extensions run with the permissions of the Integrated Development Environment, the backdoored version likely would gain access to local files and source code once installed. However, Cursor noted that due to errors in the malicious code, this step would fail outside of highly unusual circumstances where Cursor was started with administrator privileges.
Building on this
Developers should audit their Cursor extension settings to verify automatic update configurations, as this mechanism facilitated the rapid installation of the malicious version. The incident highlights the risk of supply-chain compromises in official vendor accounts; even extensions from official accounts can be targeted. Engineers should monitor for unexpected SSH keys or reverse tunnel connections on their development machines. Since the backdoor code was written for Windows, macOS, and Linux, cross-platform teams should ensure consistent security monitoring. The lack of a public notice from Anthropic suggests that internal detection and vendor response times may vary.
Why it matters
- The compromise of an official vendor account demonstrates that trust in marketplace signatures is insufficient without additional integrity checks.
- The potential exposure of environment variables and source code poses significant risks to intellectual property and credential security.
- The failure of the exploit due to code errors indicates that not all supply-chain attacks result in full system compromise, but residual risk remains.
- The absence of a public warning from Anthropic highlights the importance of independent researcher monitoring for timely incident disclosure.
Topics: Cursor, Anthropic, supply chain security, IDE extensions, SSH backdoor
Updated
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Questions readers ask
Did Anthropic confirm how the attackers accessed their account?
No, neither Cursor nor Anthropic has explained how the attackers gained control of the official distribution account.
What specific data did the malicious extension attempt to collect?
It attempted to collect hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.
Is a fix available for the compromised extension?
Yes, Anthropic pushed version 2.1.314, which replaced the malicious version 2.1.313 on the Cursor marketplace.
Connected stories
Reading receipt
- The malicious version 2.1.313 was distributed via Anthropic’s official account on the Cursor marketplace.
- Attackers attempted to install a persistent SSH backdoor by adding an unauthorized key and opening a reverse tunnel.
- Cursor reported that the exploit would fail on most systems due to code errors and lack of administrator privileges.