Tampered Claude Code extension exposed up to 5,000 Cursor users
Anthropic denied that its systems were compromised, while security researchers said the malicious software appeared under its official marketplace account.
Cursor said a maliciously altered Claude Code extension reached up to 5,000 users through its marketplace on 29 October, attempting to install an SSH backdoor on their computers. The affected Windows and macOS versions, 2.1.312 and 2.1.313, were available for about 11 hours.
The software gathered machine and user information, including hostnames, usernames, Git email addresses and public IP addresses. According to Cursor, it also attempted to install an attacker-controlled SSH key, activate SSH access and create a reverse tunnel connecting to the attacker’s server.
Cursor said the tunnel attempt would generally fail because the extension lacked administrator privileges on most affected computers. However, the key installation, persistence scripts and data upload still succeeded, and removing the extension might leave those components behind.
Anthropic technical staff member Felix Rieseberg said neither company systems nor employee laptops had been compromised. He said Anthropic had not built or published the altered extension and that copies distributed through its own channels were unaffected.
Phorion co-founder and chief technology officer Luke Roberts told Ars Technica that version 2.1.313 appeared under Anthropic’s official Cursor account. Neither company has explained how the attacker obtained access. Phorion also found that the malware transmitted names, but not values, of up to 40 environment variables associated with credentials.
Cursor removed the affected versions, temporarily closed its marketplace, rotated keys and had the attacker’s server taken offline. It later reopened the marketplace, published detection and removal scripts, and directed users to version 2.1.314.
