A verified Cursor extension for Anthropic’s Claude model was compromised and distributed to approximately 5,000 developers on Friday, according to multiple sources. The malicious version, labeled 2.1.313, was posted through Anthropic’s official account on Cursor’s marketplace before being replaced with a patched version several hours later. Security researchers and Cursor confirmed the incident involved a supply-chain compromise, though neither Anthropic nor Cursor has publicly disclosed how attackers gained access to the official account.
The backdoored extension was designed to install a persistent SSH backdoor by adding an attacker-controlled SSH key, enabling the local SSH service, and establishing a reverse SSH tunnel. The malware was engineered to function across Windows, macOS, and Linux systems. Given that Cursor extensions operate with the permissions of the integrated development environment, the compromised version would likely have accessed local files, source code, and developer tools on affected systems.
The backdoor’s functionality included harvesting variable names from the compromised device, which security researchers noted would allow threat actors to quickly inventory cloud credentials and API tokens stored locally. This capability would enable attackers to identify and prioritize high-value targets for follow-up attacks. Implementation flaws in the Windows and macOS versions of the malware prevented the backdoor from functioning in some cases, though researchers characterized it as a significant threat despite these coding errors.
Cursor’s response included coordinating with the cloud provider hosting the server that received reverse shell connections to isolate infected devices, removing the backdoored version from the marketplace, and temporarily shutting down the VSCode Marketplace to rotate security keys and audit access controls. The marketplace has since reopened. Individuals who installed or updated the extension between 5:27 am ET and 4:35 pm on Thursday should consider themselves potentially affected. Neither Anthropic nor Cursor has publicly disclosed details about how the compromise occurred or issued customer warnings about the incident.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI