A tampered copy of the Claude Code extension sat live on Cursor's marketplace for roughly 11 hours on Thursday, reaching as many as 5,000 developers before anyone caught it, according to The Register. Anthropic says the breach has nothing to do with its own infrastructure.
The poisoned package, version 2.1.313 of the official Claude Code extension for Visual Studio Code, was available between 0227 and 1335 Pacific time, Cursor told researchers. Security firm Phorion first flagged the extension as carrying a persistent SSH backdoor built to run on Windows, macOS and Linux.
Once installed, the implant collected the host machine's username, configured Git email and public IP address, then tried to open a reverse SSH tunnel back to an attacker-controlled server. There's a catch that limited the damage. Opening that tunnel required admin rights on macOS and Windows, and in most cases the script didn't have them, so the connection attempt simply failed.
That doesn't mean affected machines are clean. Even when the tunnel never opened, the extension still sent host and user data to the attacker, dropped the attacker's SSH key on the machine and installed a persistence mechanism. Cursor and Phorion both say developers who had the compromised version installed need to actively hunt for the infection, because updating to a newer extension release does not remove it on its own.
Cursor has published remediation instructions and download scripts meant to wipe the infection, laid out in its own incident writeup.
Anthropic pushes back on blame
Online chatter following the discovery pointed fingers at Anthropic, with some cybersecurity voices suggesting the tampered extension traced back to a compromise of Anthropic's own systems. Felix Rieseberg, a member of Anthropic's technical staff, pushed back on that directly in a post Thursday.
"We're working with Cursor on this incident, but it wasn't a compromise of Anthropic's systems or employee laptops," Rieseberg wrote. "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish. The versions on our official channels are not affected, and this only impacts Cursor users."
Cursor's own account backs that framing without explaining how the attacker got into its marketplace in the first place. "We removed the malicious version from the marketplace immediately upon detection and blocked further distribution," the company said in its advisory, adding that it shut down the entire VS Code Marketplace as a precaution, checked other extensions for similar tampering, rotated its keys and worked with a cloud provider to cut off the attacker's server.
Neither Cursor nor Anthropic has said publicly how the attacker gained the access needed to push a malicious update to begin with. Anyone who installed the Claude Code extension through Cursor's marketplace around that 11-hour window on Thursday should check Cursor's advisory and run its cleanup scripts rather than assume a fresh install has fixed things.
ADFiled by The AI Desk
Models, assistants and the companies and chips behind them, reported from what was released and what was claimed, with the difference kept clear.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.