Anthropic extension compromised

An official Anthropic Claude extension for VS Code on Cursor was backdoored, affecting at most five thousand developers. The malicious version was version two point one point three one three.

How attackers gained access

The malicious version was posted to Anthropic's official account on Cursor, replacing version two point one point three one two.Extensions auto-update by default in Cursor.Neither Cursor nor Anthropic has explained how attackers gained control.

“It was a supply-chain compromise where the attacker gained access to the official distribution channel.”

What the backdoor did

The malicious extension attempted to install a persistent SSH backdoor using an attacker-controlled SSH key. It enabled the local SSH service and opened a reverse SSH tunnel. The code worked on Windows, macOS, and Linux.

Data the backdoor collected

The backdoor collected hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP. It attempted to add an attacker-controlled SSH key to authorized_keys.

Why variable names mattered

Phorion said theft of variable names allowed the operator to quickly take inventory of cloud credentials and API tokens stored on compromised devices. This likely helped prioritize which machines to target in follow-up attacks.

Response and removal

Cursor personnel worked with the cloud provider to block infected devices from reaching the reverse shell server.

Timeline and unanswered questions

Anyone who installed or updated the extension between five twenty-seven am ET and four thirty-five pm on Thursday should consider themselves affected.