An official extension for Anthropic’s Claude model had a backdoor and threatened up to 5,000 developer machines, multiple sources reported Friday. Anthropic has so far not yet warned customers about the incident.
The compromised package was a commercially available VS Code extension from Cursor, a maker of AI-assisted development tools, the company said on Friday. The malicious version, 2.1.313, subsequently affected “at most 5,000 users,” presumably when they downloaded it or their systems automatically searched for and installed it. Anthropic released version 2.1.314 several hours after the previous version was available on Cursor, according to independent researcher Kevin Beaumont. Both Beaumont and the CTO and co-founder of security firm Phorian said that version 2.1.313 was distributed through Anthropic’s official account on Cursor. So far, neither Cursor nor Anthropic have explained how the attackers gained control of the account.
Searching for cloud credentials
“It was a supply chain compromise where the attacker gained access to the official distribution channel,” Phorian CTO and co-founder Luke Roberts told Ars. “The malicious version 2.1.313 was posted to the official Anthropic account, effectively replacing 2.1.312. Extensions are automatically updated in Cursor by default, but users can configure this in settings.” Phorian has more details here.
Anthropic has yet to issue a public notice of the incident to customers.
Cursor said that the malicious extension attempts to install a persistent SSH backdoor using an aggregated SSH key controlled by the attacker, enabling the local SSH service and opening a reverse SSH tunnel. The code was written to run on Windows, macOS, and Linux. Because Cursor extensions run with the permissions of the tool’s integrated development environment, the backdoored version would likely gain access to local files, source code, and developer tools once installed.
