Cursor Confirms Anthropic Claude Code Extension Compromised

3rd Party Risk Management , Agentic AI , Application Security

Attackers backdoored the official Claude Code VS Code extension being distributed on the Cursor Marketplace.

The malicious version of the extension, downloadable for 11 hours on Thursday, was designed to give attackers persistent SSH access to any endpoint on which the extension was installed.

San Francisco-based Cursor, owned by SpaceX subsidiary SpaceXAI, said in a security alert that the malicious version, 2.1.313, of the official Claude Code extension was available from the Cursor Marketplace Thursday from approximately 9:27 a.m. to 8:35 p.m. UTC.

The company develops the Cursor artificial intelligence coding agent and software development environment, and offers the Cursor Marketplace to serve extensions for the Cursor editor.

"We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products," Cursor said in a social media post at 7:46 a.m. UTC on Friday.

"In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware and have reinstated the marketplace after confirming there is no further risk," it said.

The company added that it will be directly contacting all users who downloaded version 2.1.313 of the extension, and has published instructions for searching for signs of compromise. Researchers said any system on which 2.1.313 has been installed should be immediately isolated and subjected to a digital forensic investigation.

Anthropic has also confirmed the attack. "A malicious actor used access to Cursor's marketplace to publish a tampered extension targeting Cursor's users, we were not involved with building, publishing or hosting this," it said.

Cursor hasn't shared details on how the supply-chain attack was carried out or who might be behind it.

Researchers said the implant surreptitiously added to the Claude Code VS Code extension is designed to give an attacker a reverse SSH tunnel, aka remote port forwarding, to the infected endpoint, which allows a remote attacker to connect, even if a firewall or network address translation is in place.

Phorion, which develops macOS endpoint detection and response tools, appeared to be the first to publicly flag the malicious extension, which it said featured the ability to execute on any Windows, Linux or macOS system, and could gain access to many different types of data.

"Because extensions run with the permissions of the IDE and the user running it, a backdoored extension gets immediate access to local files, source code and developer tooling as soon as its module is loaded," Phorion said in a Friday report.

Cursor said malicious code "attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel" but that "outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail."

Security researcher Paul McCarty said in a Friday report posted to the OpenSource Malware site that the malicious version was the same as the legitimate version except for its extension.js file, which gets run whenever the extension starts up, and which "contains a malicious 66-line loader inserted before the legitimate extension code," meaning users wouldn't need to first interact with Claude for the attack to commence.

The loader "adds an attacker-controlled key to the user's SSH configuration, attempts to enable the local SSH service, establishes a reverse tunnel to 134.209.82.225, installs platform-specific persistence and transmits host reconnaissance over an unencrypted HTTP beacon," while also suppressing any errors that might normally get generated, McCarty said.

The reconnaissance conducted by the implant includes gathering the hostname and local username, details of the operating system and CPU architecture, home and the current directory name, the global Git email address attached to code commits, as well as "names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS or GCP," he said.

Whether the implant was passing this information to a command-and-control server wasn't clear. But with SSH access to the endpoint, an attacker could easily gather it all directly, he said.

Cursor said the attack server is now no longer reachable. "We worked with the cloud provider that was hosting it to take it offline, so the reverse shell and host detail POST are not functional," it said.

The malware's attempt to activate the local SSH service also would require admin-level rights, which the extension wouldn't typically have on macOS and Windows hosts, at which point no reverse SSH tunnel would be created, Cursor said. Even so, "the extension still adds the attacker's SSH key, installs persistence, and sends host details to the attacker," and even these infections should be remediated, it said.

Cursor said it reviewed all other extensions being offered on the Cursor Marketplace after taking it offline Thursday and found no signs of tampering, before it restored the Marketplace late Thursday, Pacific Time.

Anthropic issued version 2.1.314 of the extension, which omits the malicious code, Thursday evening.

"The new, replacement versions Anthropic published overnight - which auto update - do not remove the prior backdoors and recon activity. So, SSH still reverse calls out, etc., you need to manually remediate every impacted VS Code and Cursor system," said British cybersecurity researcher Kevin Beaumont in a Friday post to social platform Mastodon.