A compromised version of Anthropic’s Claude Code extension remained on Cursor’s extension marketplace for about 11 hours, exposing as many as 5,000 users to a cyberattack targeting developers’ computers.
The malicious extension attempted to install an SSH backdoor on affected machines, potentially allowing attackers to gain persistent access, according to a security notice published by Cursor.
The affected versions, 2.1.312 and 2.1.313, were available for Windows and macOS users between 2:27am and 1:35pm Pacific time on Thursday, October 29.
Cursor said Anthropic did not develop the malicious code, while Anthropic maintained that its own systems had not been breached.
However, a security firm that investigated the incident said the compromised extension was distributed through Anthropic’s official account on Cursor’s marketplace.
Neither company has disclosed how the attacker gained access.
According to Cursor, the malicious extension collected information from affected computers, including hostnames, usernames, Git email addresses and public IP addresses.
It also attempted to insert the attacker’s SSH key into the machines, activate their Secure Shell service and establish a reverse tunnel to an external server controlled by the attacker.
The reverse tunnel operation required administrator privileges, which the extension generally did not have on most Windows and macOS devices.
As a result, that part of the attack would typically fail, Cursor said.
However, the key, persistence scripts and data transfers were successfully executed.
Cursor warned that simply uninstalling the extension might not remove all malicious components from affected devices.
“We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the http://cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.
“In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
“If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314,” Cursor said in the statement.
Cursor removed the compromised versions and temporarily shut down its entire extension marketplace to review other listings. The platform later rotated its security keys and reopened the marketplace after completing its checks. It also secured the shutdown of the attacker’s server and released scripts to help users detect and remove the backdoor from affected devices.
