Anthropic’s Cursor extension backdoored, threatening 5,000 developer machines

Multiple sources reported on Friday that an official Anthropic extension was backdoored, threatening up to 5,000 developer machines while the company remained silent.reported

What was released or claimed

Cursor stated that malicious version 2.1.313 of the VS Code extension was available on its marketplace.reported The package attempted to install a persistent SSH backdoor by adding an attacker-controlled key, enabling the local SSH service, and opening a reverse SSH tunnel. The code targeted Windows, macOS, and Linux systems. Because Cursor extensions run with the permissions of the Integrated Development Environment, the backdoored version likely would gain access to local files, source code, and developer tooling once it was installed. The backdoor also attempted to collect host and user information, including hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP.

Who it affects

The compromised package affected at most 5,000 users, according to the report.reported These users presumably downloaded version 2.1.313 or had their systems automatically fetch and install it. Extensions in Cursor auto-update by default, though users can configure this setting. The malicious version was distributed through Anthropic’s official account on Cursor, superseding the previous version 2.1.312.reported Anthropic pushed version 2.1.314 several hours after the malicious version became available, according to independent researcher Kevin Beaumont.reported

What is still unknown

It remains unknown how attackers gained access to Anthropic’s verified Cursor account. Neither Cursor nor Anthropic has explained the method of compromise. Phorian CTO and co-founder Luke Roberts described it as a supply-chain compromise where the attacker accessed the official distribution channel. Outside of highly unusual circumstances where Cursor was started with administrator privileges, the step to add the SSH key would fail due to errors in the malicious code, according to Cursor.reported

What to make of it

The incident highlights the risk of automated updates in developer tooling. The backdoor was designed to work across multiple operating systems and collect sensitive environment data. The fact that the malicious code was posted to the official Anthropic account means users trusted the source. The failure of the SSH key installation in non-admin scenarios suggests the attackers’ code had flaws, but the data collection component attempted to run.

What buyers should weigh

Organizations using AI-assisted developer tools must evaluate the security of their extension update policies. Since extensions run with IDE permissions, a compromise grants access to source code and local files. Buyers should verify if vendors provide timely incident notifications, as Anthropic had not warned customers by Friday. The supply-chain nature of the attack means trust in the vendor’s account security is critical.