Ing. Calogero Bono
On Thursday a tampered version of the Claude Code extension for Visual Studio Code sat on Cursor's marketplace for about 11 hours. It contains an SSH backdoor designed for Windows, macOS and Linux. According to Cursor, it reached at most 5,000 users. It matters because the extension runs with the permissions of your development environment, so it can reach local files and source code. We already covered this in our first report.
A few terms before we get into the facts. Backdoor is a hidden service entry point that lets an attacker get back into a computer. SSH is a protocol for controlling a computer remotely. A reverse SSH tunnel is a connection opened from the victim's computer out to the attacker. Supply chain refers to an attack that passes through a trusted supplier or distribution channel. EDR is software that detects abnormal behavior on corporate devices.
What happened on Cursor?
According to Wired, Cursor, which is owned by SpaceX, hosted a malicious Claude Code extension for about 11 hours. The company speaks of downloads by "at most 5,000 users" and temporarily closed the marketplace.
According to The Register, version 2.1.313 was downloadable between 02:27 and 13:35 Pacific on Thursday, that is from 09:27 to 20:35 UTC. It was discovered by Phorion, an EDR provider, after being detected on a customer's Mac.
What does the backdoor do?
According to Ars Technica, Cursor reports that the code attempts to install a persistent SSH backdoor. It adds the attacker's SSH key, enables the local SSH service and opens a reverse tunnel.
Vendor analyses, reported by The Register, also show the collection of usernames, configured Git emails and public IP addresses. This data is sent to the attacker.
Because Cursor's extensions work with the permissions of the development environment, the infected version would likely have access to local files, source code and development tools.
Why was the damage limited?
The malware had a flaw. The script that opens the SSH tunnel required administrator rights on macOS and Windows and in the vast majority of cases did not have them, so it failed. Wired calls it a stroke of luck.
Calum Hall of Phorion said that "everyone has been very lucky, this could have been a really dangerous foothold for an attacker".
The flaw does not eliminate the risk. The extension still sends the collected data, leaves the attacker's key in place and installs the persistence mechanism.
Who is responsible?
Anthropic denies any compromise. Felix Rieseberg, from its technical staff, wrote that an attacker used access to Cursor's marketplace to publish an altered copy, and that the versions on official channels are not affected. There are further notes on this case in our article on Claude Code 2.1.314.
Early reconstructions differed. Ars Technica writes that 2.1.313 reportedly came through Anthropic's official account on Cursor. Cursor, according to Wired, stated that the malicious versions were not developed by Anthropic. How the attacker obtained access remains unexplained.
Limits to know
It is not clear how the package got onto the marketplace. Cursor has not explained whether there was an internal breach and did not respond to Wired. The 5,000-user figure is a maximum stated by the company, not an independently verified number. Sources also disagree on duration, about 11 hours according to Cursor and nearly 12 according to Ars Technica. We do not know whether any access succeeded.
What changes for those working in digital
If you used Cursor on Thursday, check the installed version of the extension. Updating is not enough, because the corrected version does not remove the persistence mechanism. Use the cleanup steps and scripts Cursor has published and look for unknown SSH keys. Anyone who manages servers or repositories accessed from a laptop should rotate credentials and keys. The case shows how much weight suppliers carry in the workflow, a topic we cover in our guide to the NIS2 supplier register.
Our take
The fact that the attack failed almost everywhere is luck, not a defense. An extension marketplace with automatic updates enabled by default is a privileged channel into developers' machines, and it should be treated as one. Anthropic is right to clarify that its systems are not involved, but for the user that distinction matters little, because the name on the extension was the one they trusted. Cursor needs to be transparent about how the access was obtained.
Frequently asked questions
Who was affected by the infected Claude Code extension?
Only people who use Cursor and installed version 2.1.313. According to Anthropic, the versions on its official channels are not affected. Cursor estimates at most 5,000 users.
How long was the malicious version available?
About 11 hours, according to Cursor and The Register. It could be downloaded on Thursday between 09:27 and 20:35 UTC. Ars Technica reports nearly 12 hours.
Is it enough to update the extension to be safe?
No. Installing the latest version does not remove the persistence mechanism the malware left behind. You need the cleanup steps and scripts indicated by Cursor.
Was Anthropic hacked?
According to Anthropic, no. Rieseberg and Dworken state that there was no compromise of its systems or employee laptops. An attacker reportedly used access to Cursor's marketplace.
What did Cursor do after the incident?
It removed the malicious version, temporarily closed the marketplace as a precaution and checked the other extensions. It also rotated its own keys and, with a cloud provider, blocked the connection to the attacker's server.
What to expect from Cursor and Anthropic in the coming weeks
The missing piece is the cause. Until Cursor explains how the attacker got in, the risk for other marketplaces remains open.
- Follow any report Cursor publishes on the cause of the access and on the use of the rotated keys.
- Check whether Anthropic communicates directly with customers, since it has not done so so far.
- Consider turning off automatic extension updates in your editor settings.
