Anthropic Claude extension on Cursor backdoored for 12 hours

Anthropic’s official extension for the Claude model was compromised on Friday, exposing the machines of up to 5,000 developers to a backdoor. The incident occurred within Cursor, an AI-assisted development platform, where the malicious code was distributed through Anthropic’s verified account. The company has not yet issued a public warning to customers regarding the breach.

Version 2.1.313 of the extension contained the malicious payload. Independent researcher Kevin Beaumont noted that Anthropic released version 2.1.314 only several hours after the compromised update appeared. Both Beaumont and Luke Roberts, CTO and co-founder of security firm Phorian, confirmed that the bad version came directly from Anthropic’s official distribution channel. Neither Anthropic nor Cursor has explained how attackers gained control of the account.

Roberts described the event as a supply-chain compromise where the attacker superseded the previous legitimate version. The malicious code attempted to install a persistent SSH backdoor. It did this by adding an attacker-controlled SSH key, enabling the local SSH service, and opening a reverse SSH tunnel. The code was designed to function on Windows, macOS, and Linux systems.

Because Cursor extensions run with the permissions of the Integrated Development Environment, the backdoored version likely accessed local files, source code, and developer tooling. Users were affected either by downloading the update or through automatic installation, which is enabled by default in Cursor. The window of exposure lasted for nearly 12 hours before the fix was deployed.

The incident highlights the vulnerability of software supply chains when trusted accounts are compromised. Phorian provided detailed technical analysis of the attack vector. Anthropic remains silent on the specific method used to breach its official account, leaving developers to rely on the rapid patch as the primary mitigation.