Anthropic extension compromise exposes up to 5,000 Cursor developer systems

Traders Union
All News
Business & Wealth
Companies
Anthropic extension compromise

Highlights

Malicious Anthropic Claude VS Code extension version 2.1.313, distributed via Cursor’s official marketplace, potentially compromised up to 5,000 developer systems between 5:27 am and 4:35 pm Thursday.
The backdoored extension installed persistent SSH access, exfiltrated host/user data, and enabled attackers to target sensitive cloud credentials and API tokens on affected machines.
Cursor blocked further distribution, removed the malicious extension, disabled infected devices' access to the operator server, and temporarily shut down the VSCode Marketplace to audit for wider impact.

Compromised extension and attack timeline

As reported by Ars Technica, the malicious package was version 2.1.313 of Anthropic's official VS Code extension for Claude in Cursor's marketplace, and Cursor says it affects at most 5,000 users who either downloaded it directly or received it through automatic updates.

Independent researcher Kevin Beaumont says Anthropic later pushed version 2.1.314 several hours after the compromised release became available. Beaumont and Luke Roberts, CTO and co-founder of security firm Phorian, say the backdoored extension was distributed through Anthropic's official Cursor account, while the route used by attackers to gain control of that account remains unknown.

Roberts describes the incident as a supply-chain compromise in which an attacker accessed the official distribution channel. He says Cursor extensions update automatically by default, although users can change that behavior in settings.

Security impact on developer environments

Cursor says the malicious extension attempts to install a persistent SSH backdoor by adding an attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel. Because Cursor extensions run with the permissions of the integrated development environment, the compromised code likely can access local files, source code, and developer tooling once installed.

The company says the malware also collects host and user information including hostname, username, operating system, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP address. It also attempts to report host details and backdoor status to the operator through HTTP POST requests on port 8099.

Phorian says the theft of variable names can help an operator quickly identify cloud credentials and API tokens stored on an affected machine, allowing follow-up targeting of more valuable systems. Although coding errors on Windows and macOS prevent the backdoor from functioning in some cases, Roberts says the malware still poses a significant threat because it installs persistence and sends host reconnaissance data back to the attacker.

Cursor says it worked with the cloud provider hosting the reverse-shell server so infected devices can no longer reach it, removed the compromised version from the marketplace, and blocked further distribution. The company also temporarily shut down the VSCode Marketplace to rotate keys, audit access controls, and check whether any other extensions were affected, and says the marketplace is now open.

Anyone who installed or updated Anthropic's VS Code extension from Cursor between 5:27 am ET and 4:35 pm on Thursday should consider themselves affected. Cursor and Phorian have published indicators of compromise including IP addresses and cryptographic hashes, while Anthropic has not publicly warned customers about the incident.

Investor appetite for cybersecurity remained strong in Q3 2026, with global cybersecurity and privacy startups raising $6.8 billion as bigger late-stage rounds offset a decline in overall deal counts. Our earlier article also highlighted how AI- and identity-security companies attracted the bulk of funding, alongside continued consolidation through major acquisitions—underscoring how security concerns are keeping budgets and capital flowing into the sector.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.