Backdoored Anthropic Extension Threatens 5,000 Cursor Users

Anthropic’s official Claude extension for Cursor, an AI-assisted developer tool, was compromised with a malicious version (2.1.313) that reached as many as 5,000 users. The backdoored extension was distributed through Anthropic’s official Cursor account, and neither Anthropic nor Cursor has disclosed how attackers gained control. Anthropic released a patched version 2.1.314 several hours after the malicious version became available.

The malicious code attempted to establish persistent SSH access by installing an attacker-controlled SSH key, enabling the local SSH service, and creating a reverse SSH tunnel. The payload was designed to run on Windows, macOS, and Linux. Because Cursor extensions operate with the tool’s IDE permissions, successful installation would grant access to local files, source code, and developer tooling.

This represents a supply-chain compromise at the distribution point. Cursor extensions auto-update by default, meaning the malicious version would have been installed automatically on many developer machines unless users had disabled auto-updates. Anthropic has not issued a public warning to customers about the incident.