Cursor says tampered Claude Code extension in its marketplace tried to plant backdoors on developers' machines

Cursor, which makes an AI-assisted code editor, says versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension in its VS Code extension marketplace were malicious and "were not developed by Anthropic". They were available from about 02:27 to 13:35 Pacific time on 29 October. Cursor's notice, updated on 30 October, names both versions; Ars Technica's report named 2.1.313. Ars reported that the tampered release went out through Anthropic's official publisher account and that, because Cursor updates extensions automatically by default, users could receive it without doing anything. Citing Cursor, Ars said no more than 5,000 users were affected.

According to Cursor, the code sent the host name, user name, operating system and public IP address to a server run by the attacker. It also tried to add the attacker's SSH key, switch on the local SSH service and open a reverse tunnel, and to keep that tunnel alive through a macOS launch agent or a Windows scheduled task that retried about every 60 seconds. Errors in the code meant the tunnel step would usually fail unless the editor ran with administrator rights. Security firm Phorion told Ars that the stolen names of environment variables would let the operator see which cloud credentials and API tokens sat on each machine and choose targets for follow-up attacks.

Cursor removed the versions, took its marketplace offline to rotate keys and audit access, and says no other extension was altered. It also worked with the hosting provider to take the attacker's server offline. It warns that uninstalling the extension may not be enough: affected users should isolate the machine, remove the key and persistence, rotate any credentials reachable from it and, if needed, rebuild it.

Neither Cursor nor Anthropic has said how the attackers gained control of the publishing channel. When Ars published on 30 October, Anthropic had not issued a public notice and neither company had answered its questions.